CVE - CVE-2024-54133

CVE-ID
CVE-2024-54133	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49 URL:https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49 MISC:https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a URL:https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a MISC:https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542 URL:https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542 MISC:https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d URL:https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d MISC:https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v URL:https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20241129	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20241129)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)