Loading...
Skip to main content
GeekWala

CVE-2024-28103

MEDIUM

Missing security headers in Action Pack on non-HTML responses

Published June 4, 2024Updated October 6, 2025Source: osv

Summary

# Permissions-Policy is Only Served on HTML Content-Type The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This has been assigned the CVE identifier CVE-2024-28103. Versions Affected: >= 6.1.0 Not affected: < 6.1.0 Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4 Impact ------ Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- N/A Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our [maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues) regarding security issues. They are in git-am format and consist of a single changeset. * 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series * 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series * 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series Credits ------- Thank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update actionpack to 7.1.3.4 or later
gem install actionpack -v 7.1.3.4
Bundler
Update actionpack to 7.0.8.4 or later
gem install actionpack -v 7.0.8.4
Bundler
Update actionpack to 7.2.0.beta2 or later
gem install actionpack -v 7.2.0.beta2
Bundler
Update actionpack to 6.1.7.8 or later
gem install actionpack -v 6.1.7.8

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

PackageEcosystemAffectedFixed In
actionpack
rubygems
7.1.0, 7.1.1, 7.1.2, 7.1.3 (+3 more)7.1.3.4
actionpack
rubygems
7.0.0, 7.0.1, 7.0.2, 7.0.2.1 (+19 more)7.0.8.4
actionpack
rubygems
7.2.0.beta17.2.0.beta2
actionpack
rubygems
6.1.0, 6.1.1, 6.1.2, 6.1.2.1 (+23 more)6.1.7.8

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-20
    Improper Input ValidationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 5.4 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

Frequently Asked Questions

What is CVE-2024-28103?
Missing security headers in Action Pack on non-HTML responses This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.4/10).
How do I check if my project is affected by CVE-2024-28103?
CVE-2024-28103 affects actionpack. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-28103 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
5.4

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-fwhr-88qx-h9g7
BIT-rails-2024-28103

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies