CVE-2024-28103

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28103
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-28103.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-28103
Aliases
Downstream
Related
Published
2024-06-04T19:47:44.199Z
Modified
2026-03-20T12:35:52.202350Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Action Pack is missing security headers on non-HTML responses
Details

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28103.json"
}
References

Affected packages

Git / github.com/rails/rails

Affected ranges

Type
GIT
Repo
https://github.com/rails/rails
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e39361ab9062e23dcef5aeaf376fc48b106da66b
Fixed
ec7f25368dff972b014fad4294c62181fb26c584
Fixed
19eebf6d33dd15a0172e3ed2481bec57a89a2404
Database specific 
{
    "versions": [
        {
            "introduced": "6.1.0.0"
        },
        {
            "fixed": "6.1.7.8"
        },
        {
            "introduced": "7.0.0.0"
        },
        {
            "fixed": "7.0.8.4"
        },
        {
            "introduced": "7.1.0.0"
        },
        {
            "fixed": "7.1.3.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/rails/rails
Events
Introduced
9098f535b2accef27c6c284dede119c936c44595
Fixed
b752c38e81a310c1aaca78c7cdd1784009ea189a
Database specific 
{
    "versions": [
        {
            "introduced": "7.2.0.beta1"
        },
        {
            "fixed": "7.2.0.beta2"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.0
v0.13.0
v0.13.1
v0.14.1
v0.14.3
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.4.1
v0.9.5
v1.*
v1.1.0
v1.1.0_RC1
v1.1.1
v2.*
v2.0.0
v2.0.0_PR
v2.0.0_RC1
v2.0.0_RC2
v2.0.1
v2.1.0
v2.1.0_RC1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.2.1
v3.*
v3.0.0.beta.2
v3.0.0.beta.3
v3.0.0.beta1
v3.0.0.beta2
v3.0.0.beta3
v3.0.0.beta4
v3.0.0_RC
v3.1.0.beta1
v3.1.0.rc1
v3.2.0.rc1
v4.*
v4.0.0.beta1
v4.0.0.rc1
v4.1.0.beta1
v4.1.0.beta2
v4.2.0.beta1
v4.2.0.beta4
v5.*
v5.0.0.beta1
v5.0.0.beta1.1
v5.0.0.beta2
v5.0.0.beta3
v5.0.0.beta4
v5.0.0.rc1
v5.1.0.beta1
v6.*
v6.0.0.beta1
v6.0.0.beta2
v6.0.0.beta3
v6.1.0
v6.1.0.rc1
v6.1.0.rc2
v6.1.1
v6.1.2
v6.1.2.1
v6.1.3
v6.1.3.1
v6.1.3.2
v6.1.4
v6.1.4.1
v6.1.4.2
v6.1.4.3
v6.1.4.4
v6.1.4.5
v6.1.4.6
v6.1.4.7
v6.1.5
v6.1.5.1
v6.1.6
v6.1.6.1
v6.1.7
v6.1.7.1
v6.1.7.2
v6.1.7.3
v6.1.7.4
v6.1.7.5
v6.1.7.6
v6.1.7.7
v7.*
v7.0.0
v7.0.0.alpha1
v7.0.0.alpha2
v7.0.0.rc1
v7.0.0.rc2
v7.0.0.rc3
v7.0.1
v7.0.2
v7.0.2.1
v7.0.2.2
v7.0.2.3
v7.0.2.4
v7.0.3
v7.0.3.1
v7.0.4
v7.0.4.1
v7.0.4.2
v7.0.4.3
v7.0.5
v7.0.5.1
v7.0.6
v7.0.7
v7.0.7.1
v7.0.7.2
v7.0.8
v7.0.8.1
v7.0.8.2
v7.0.8.3
v7.1.0
v7.1.0.beta1
v7.1.0.rc1
v7.1.0.rc2
v7.1.1
v7.1.2
v7.1.3
v7.1.3.1
v7.1.3.2
v7.1.3.3
v7.2.0.beta1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-28103.json"