CVEvulnerability

CVE-2024-28103

9.8 CRITICAL Published 2024-06-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-06-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20

Description

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

Affected configurations

• rubyonrails rails (>= 6.1.0 < 6.1.7.8) • rubyonrails rails (>= 7.0.0 < 7.0.8.4) • rubyonrails rails (>= 7.1.0 < 7.1.3.4) • rubyonrails rails 7.2.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References