Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ruby_advisory_db / gems/actionpack/CVE-2024-54133
Advisory ID ruby_advisory_db/gems/actionpack/CVE-2024-54133
Aliases CVE-2024-54133
GHSA-vfm5-rmrh-j26v
Summary Possible Content Security Policy bypass in Action Dispatch There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack. ## Impact Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. ## Releases The fixed releases are available at the normal locations. ## Workarounds Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input. ## Credits Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv4 2.3
Reference id Reference type URL
GHSA-vfm5-rmrh-j26v https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-11T16:05:59Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2024/54xxx/CVE-2024-54133.json

Source Advisory: vulnrichment/CVE-2024-54133

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]