Fluid Attacks Database

Description

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	rails	>=0 <2:7.2.2.1+dfsg-1	2:7.2.2.1+dfsg-1
debian 12	rails	=2:6.1.7.3+dfsg-1 \|\| =2:6.1.7.3+dfsg-10 \|\| =2:6.1.7.3+dfsg-11 \|\| =2:6.1.7.3+dfsg-12 \|\| =2:6.1.7.3+dfsg-13 \|\| =2:6.1.7.3+dfsg-2 \|\| =2:6.1.7.3+dfsg-2~deb12u1 \|\| =2:6.1.7.3+dfsg-3 \|\| =2:6.1.7.3+dfsg-4 \|\| =2:6.1.7.3+dfsg-5 \|\| =2:6.1.7.3+dfsg-6 \|\| =2:6.1.7.3+dfsg-7 \|\| =2:6.1.7.3+dfsg-7~exp1 \|\| =2:6.1.7.3+dfsg-8 \|\| =2:6.1.7.3+dfsg-9 \|\| >=0 <2:6.1.7.10+dfsg-1~deb12u1	2:6.1.7.10+dfsg-1~deb12u1
debian 14	rails	>=0 <2:7.2.2.1+dfsg-1	2:7.2.2.1+dfsg-1
rubygems	actionpack	>=5.2.0 <7.0.8.7 \|\| >=7.1.0 <7.1.5.1 \|\| >=7.2.0 <7.2.2.1 \|\| >=8.0.0 <8.0.0.1	7.0.8.7, 7.1.5.1, 7.2.2.1, 8.0.0.1

Aliases

1. CVE-2024-541332. NVD-2024-541333. OSV-DEBIAN-2024-541334. OSV-2024-541335. GHSA-vfm5-rmrh-j26v6. GCVE-2024-541337. SECURITY-TRACKER-CVE-2024-54133

References

1. https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v2. https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c493. https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a4. https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b5425. https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d6. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml7. https://security.netapp.com/advisory/ntap-20250306-0010

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.