CVE-2024-54133
Possible Content Security Policy bypass in Action Dispatch
Description
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
How to fix CVE-2024-54133
To remediate CVE-2024-54133, upgrade the affected package to a fixed version below.
- —upgrade to 7.0.9 or later
- —upgrade to 2:6.0.3.7+dfsg-2+deb11u3 or later
- —upgrade to 7.0.8.7 or later
Is CVE-2024-54133 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- >= 5.2.0, < 7.0.9, >= 7.1.0, < 7.1.4, >= 7.2.0, < 7.2.2-2-0, >= 8.0.0, < 8.0.1
- from 0, < 2:6.0.3.7+dfsg-2+deb11u3
- >= 5.2.0, < 7.0.8.7
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |