PT-2024-10114 · Ruby On Rails+4 · Action Pack+4

Shinkbr

·

Published

2024-06-04

·

Updated

2026-05-09

·

CVE-2024-28103

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Action Pack versions 6.1.0 through 6.1.7.7 Action Pack versions 7.0.0 through 7.0.8.1 Action Pack versions 7.1.0 through 7.1.3.2
Description The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This issue is related to insufficient input validation, which may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability concerns non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.
Recommendations For Action Pack versions 6.1.0 through 6.1.7.7, update to version 6.1.7.8. For Action Pack versions 7.0.0 through 7.0.8.1, update to version 7.0.8.2. For Action Pack versions 7.1.0 through 7.1.3.2, update to version 7.1.3.3. As a temporary workaround, consider restricting access to non-HTML Content-Types until a patch is available. Apply the provided patches for the supported release series, such as 6-1-include-permissions-policy-header-on-non-html.patch, 7-0-include-permissions-policy-header-on-non-html.patch, or 7-1-include-permissions-policy-header-on-non-html.patch, to aid in immediately addressing the issue.

Exploit

Fix

RCE

Weakness Enumeration

Related Identifiers

ALT-PU-2025-3714
BDU:2025-00338
BIT-RAILS-2024-28103
CVE-2024-28103
DSA-5881-1
GHSA-FWHR-88QX-H9G7
OESA-2024-1708
OESA-2024-1709
OESA-2024-1710
OPENSUSE-SU-2024:14067-1
OPENSUSE-SU-2024:14074-1
OPENSUSE-SU-2024:14110-1
OPENSUSE-SU-2024_1974-1
OPENSUSE-SU-2025:15110-1
OPENSUSE-SU-2025:15124-1
SUSE-SU-2024:1973-1
SUSE-SU-2024:1974-1
SUSE-SU-2024:1986-1
SUSE-SU-2024:2140-1
SUSE-SU-2024_1973-1
SUSE-SU-2024_1974-1
SUSE-SU-2024_1986-1
SUSE-SU-2024_2140-1

Affected Products

Alt Linux
Action Pack
Debian
Red Os
Suse