CVE-2024-28103

MEDIUM

Action Pack is missing security headers on non-HTML responses

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-28103 has a selected CVSS score of 5.4 (medium).

Description

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 20, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

rails

Browse rails / rails

Default status: unknown

CVE List6.1.0.0 to < 6.1.78affected
7.0.0.0 to < 7.0.8.4affected
7.1.0.0 to < 7.1.3.4affected
7.2.0.beta1 to < 7.2.0.beta2affected
>= 6.1.0.0, < 6.1.7.8affected
>= 7.0.0.0, < 7.0.8.4affected
>= 7.1.0.0, < 7.1.3.4affected
>= 7.2.0.beta1, < 7.2.0.beta2affected

actionpack

Browse RubyGems / actionpack
GitHub Advisory6.1.0 to < 6.1.7.8 · Fixed in 6.1.7.8affected
7.0.0 to < 7.0.8.4 · Fixed in 7.0.8.4affected
7.1.0 to < 7.1.3.4 · Fixed in 7.1.3.4affected
7.2.0.beta1affected
7.2.0.beta1 to < 7.2.0.beta2 · Fixed in 7.2.0.beta2affected

References

6