CVE-2024-28103mediumCWE-20

CVE-2024-28103: falha de média gravidade em rails

Action Pack is missing security headers on non-HTML responses

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rails+ Monitorar rails

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.7%
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
rails · rails
CVEs relacionadas — rails

No mesmo produto, das mais perigosas para as menos.

CVE-2026-66066CRITICALAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingEPSS 32.9%CVE-2022-23633HIGHExposure of sensitive information in Action PackEPSS 2.2%CVE-2024-26142HIGHRails possible ReDoS vulnerability in Accept header parsing in Action DispatchEPSS 1.5%CVE-2024-26144MEDIUMPossible Sensitive Session Information Leak in Active StorageEPSS 1.3%CVE-2010-3299—CVE-2010-3299EPSS 1.1%CVE-2024-41128MEDIUMAction Dispatch has possible ReDoS vulnerability in query parameter filteringEPSS 1.1%