CVE-2014-0014: ember-source Cross-site Scripting vulnerability
5.4
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.52183%
CWE
Published
5/14/2022
Updated
4/24/2023
KEV Status
No
Technology
Ruby
RubyTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ember-source | rubygems | >= 1.0.0.pre4.0, < 1.0.1 | 1.0.1 |
| ember-source | rubygems | >= 1.1.0, < 1.1.3 | 1.1.3 |
| ember-source | rubygems | >= 1.2.0.beta.1, < 1.2.1 | 1.2.1 |
| ember-source | rubygems | >= 1.3.0.beta.1, < 1.3.1 | 1.3.1 |
| ember-source | rubygems | = 1.4.0-beta.1 | 1.4.0-beta.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from improper output escaping in the {{group}} helper implementation. The commit diff shows the fix added escapeExpression handling to the simpleBind function in binding.js, which is responsible for rendering grouped content. Prior to this fix, user-controlled input passed through {{group}} would render raw HTML without sanitization. The accompanying test cases in group_test.js verify that normal mustaches now escape HTML while triple mustaches allow it, confirming the vulnerability existed in the rendering logic of the group helper's binding implementation.