CVE-2013-6415

actionpack vulnerable to Cross-site Scripting

4.3 MediumFix available

CVE-2013-6415 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published December 7, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.17%, the 88th percentile. Fixed in actionpack 3.2.16.

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

Exploit likelihood

3.17%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2013-6415
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-6415
Updated: 2026-11-02

EUVDEUVD-2017-0175 No score

Record: EUVD-2017-0175
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6h5q-96hp-9jgm No score

actionpack vulnerable to Cross-site Scripting

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

Record: GHSA-6h5q-96hp-9jgm
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-6h5q-96hp-9jgm No score

actionpack vulnerable to Cross-site Scripting

Record: GHSA-6h5q-96hp-9jgm
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-6415 No score

Record: UBUNTU-CVE-2013-6415
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`actionpack` RubyGems	3.0.0 up to 3.2.16	3.2.16
`actionpack` RubyGems	4.0.0 up to 4.0.2	4.0.2
`ruby-actionpack-3.2` Debian:7	before 3.2.6-6+deb7u1, plus listed versions 3.2.6-6	3.2.6-6+deb7u1
`actionpack` RubyGems	3.0.0 up to 3.2.16, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 45 moreShow less 3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10	3.2.16
`actionpack` RubyGems	4.0.0 up to 4.0.2, plus listed versions 4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4	4.0.2
`ruby193-rubygem-actionpack` Red Hat:rhel_software_collections:1::el6	before 1:3.2.8-5.1.el6	1:3.2.8-5.1.el6
`ruby193-rubygem-actionpack-doc` Red Hat:rhel_software_collections:1::el6	before 1:3.2.8-5.1.el6	1:3.2.8-5.1.el6
`ruby193-rubygem-actionpack` Red Hat:openstack:3::el6	before 1:3.2.8-5.1.el6	1:3.2.8-5.1.el6
`ruby193-rubygem-actionpack-doc` Red Hat:openstack:3::el6	before 1:3.2.8-5.1.el6	1:3.2.8-5.1.el6