Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2024-28103

Action Pack is missing security headers on non-HTML responses

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

rails rails

  • >= 6.1.0.0, < 6.1.7.8affected
  • >= 7.0.0.0, < 7.0.8.4affected
  • >= 7.1.0.0, < 7.1.3.4affected
  • >= 7.2.0.beta1, < 7.2.0.beta2affected

References