PT-2024-10400 · Unknown+3 · Action Pack+3
Jhawthorn
+1
·
Published
2024-12-10
·
Updated
2026-03-16
·
CVE-2024-54133
CVSS v4.0
2.3
Low
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
Action Pack versions 5.2.0 through 7.0.8.6
Action Pack versions 7.0.8.7 through 7.1.5.0
Action Pack versions 7.1.5.1 through 7.2.2.0
Action Pack versions 7.2.2.1 through 8.0.0.0
Description
The issue is related to the
content security policy helper in Action Pack, which may allow an attacker to conduct Cross Site Scripting (XSS) attacks by injecting new directives into the Content-Security-Policy (CSP) headers. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Applications that set CSP headers dynamically from untrusted user input may be vulnerable.Recommendations
For Action Pack versions 5.2.0 through 7.0.8.6, update to version 7.0.8.7 or later.
For Action Pack versions 7.0.8.7 through 7.1.5.0, update to version 7.1.5.1 or later.
For Action Pack versions 7.1.5.1 through 7.2.2.0, update to version 7.2.2.1 or later.
For Action Pack versions 7.2.2.1 through 8.0.0.0, update to version 8.0.0.1 or later.
As a temporary workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Action Pack
Debian
Red Os