Tóm tắt nhanh
- CVE-2024-54133 là lỗ hổng mức THẤP (CVSS 2.3) ảnh hưởng actionpack.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.0%, cao hơn 62.9% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 7.0.8.7, 7.1.5.1, 7.2.2.1, 8.0.0.1 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| actionpack RubyGems | ≥ 5.2.0, < 7.0.8.7≥ 7.1.0, < 7.1.5.1≥ 7.2.0, < 7.2.2.1≥ 8.0.0, < 8.0.0.1
| 7.0.8.77.1.5.17.2.2.18.0.0.1
|
Mô tả
There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.
Impact
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.
Releases
The fixed releases are available at the normal locations.
Workarounds
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Credits
Thanks to ryotak for the report!
Mô tả của NVD
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí