PT-2024-10114 · Ruby On Rails+4 · Action Pack+4
Shinkbr
·
Published
2024-06-04
·
Updated
2026-05-09
·
CVE-2024-28103
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Action Pack versions 6.1.0 through 6.1.7.7
Action Pack versions 7.0.0 through 7.0.8.1
Action Pack versions 7.1.0 through 7.1.3.2
Description
The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This issue is related to insufficient input validation, which may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability concerns non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.
Recommendations
For Action Pack versions 6.1.0 through 6.1.7.7, update to version 6.1.7.8.
For Action Pack versions 7.0.0 through 7.0.8.1, update to version 7.0.8.2.
For Action Pack versions 7.1.0 through 7.1.3.2, update to version 7.1.3.3.
As a temporary workaround, consider restricting access to non-HTML Content-Types until a patch is available. Apply the provided patches for the supported release series, such as 6-1-include-permissions-policy-header-on-non-html.patch, 7-0-include-permissions-policy-header-on-non-html.patch, or 7-1-include-permissions-policy-header-on-non-html.patch, to aid in immediately addressing the issue.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Action Pack
Debian
Red Os
Suse