CVE-2024-28103
Action Pack is missing security headers on non-HTML responses
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Action Pack is missing security headers on non-HTML responses
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
- Record
CVE-2024-28103- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-2044
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
- Record
EUVD-2024-2044- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fwhr-88qx-h9g7
Missing security headers in Action Pack on non-HTML responses
Permissions-Policy is Only Served on HTML Content-Type
The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type.
This has been assigned the CVE identifier CVE-2024-28103.
Versions Affected: >= 6.1.0 Not affected: < 6.1.0 Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4
Impact
Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.
Releases
The fixed releases are available at the normal locations.
Workarounds
N/A
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset.
- 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
- 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
- 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series
Credits
Thank you shinkbr for reporting this!
- Record
GHSA-fwhr-88qx-h9g7- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
- Record
CVE-2024-28103- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Action Pack is missing security headers on non-HTML responses
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
- Record
CVE-2024-28103- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-28103
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
- Record
DEBIAN-CVE-2024-28103- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 15 moreShow less
OSVGHSA-fwhr-88qx-h9g7
Missing security headers in Action Pack on non-HTML responses
Permissions-Policy is Only Served on HTML Content-Type
The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type.
This has been assigned the CVE identifier CVE-2024-28103.
Versions Affected: >= 6.1.0 Not affected: < 6.1.0 Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4
Impact
Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.
Releases
The fixed releases are available at the normal locations.
Workarounds
N/A
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset.
- 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
- 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
- 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series
Credits
Thank you shinkbr for reporting this!
- Record
GHSA-fwhr-88qx-h9g7- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVOESA-2024-1708
rubygem-actionpack security update
Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser.
Security Fix(es):
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.(CVE-2024-28103)
- Record
OESA-2024-1708- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2024-1709
rubygem-actionpack security update
Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser.
Security Fix(es):
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.(CVE-2024-28103)
- Record
OESA-2024-1709- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2024-1710
rubygem-actionpack security update
Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser.
Security Fix(es):
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.(CVE-2024-28103)
- Record
OESA-2024-1710- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-28103
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
- Record
UBUNTU-CVE-2024-28103- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-rails-2024-28103 No score
Action Pack is missing security headers on non-HTML responses
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
- Record
BIT-rails-2024-28103- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14067-1 No score
ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14067-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14074-1 No score
ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14074-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14110-1 No score
rmt-server-2.18-1.1 on GA media
These are all security issues fixed in the rmt-server-2.18-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14110-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15110-1 No score
ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 on GA media
These are all security issues fixed in the ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15110-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15124-1 No score
ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15124-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1973-1 No score
Security update for rmt-server
This update for rmt-server fixes the following issues:
- Update to version 2.17
- CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. (bsc#1225997)
- Record
SUSE-SU-2024:1973-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1974-1 No score
Security update for rmt-server
This update for rmt-server fixes the following issues:
- Update to version 2.17
- CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. (bsc#1225997)
- Record
SUSE-SU-2024:1974-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1986-1 No score
Security update for rmt-server
This update for rmt-server fixes the following issues:
- Update to version 2.17
- CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. (bsc#1225997)
- Record
SUSE-SU-2024:1986-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2140-1 No score
Security update for rmt-server
This update for rmt-server fixes the following issues:
- Update to version 2.17
- CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. (bsc#1225997)
- Record
SUSE-SU-2024:2140-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
6.1.0 up to 6.1.7.8 | 6.1.7.8 |
actionpackRubyGems |
7.0.0 up to 7.0.8.4 | 7.0.8.4 |
actionpackRubyGems |
7.1.0 up to 7.1.3.4 | 7.1.3.4 |
actionpackRubyGems |
7.2.0.beta1 to 7.2.0.beta1 | 7.2.0.beta2 |
railsBitnami |
6.1.0 up to 6.1.8, 7.0.0 up to 7.0.9, 7.1.0 up to 7.1.4 | 6.1.87.0.97.1.4 |
railsDebian:12 |
before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions 2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13 Show 10 moreShow less2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9 |
2:6.1.7.10+dfsg-1~deb12u1 |
railsDebian:13 |
before 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
railsDebian:14 |
before 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
railsDebian:12 From an advisory covering 9 CVEs |
before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions 2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13 Show 10 moreShow less2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9 |
2:6.1.7.10+dfsg-1~deb12u1 |
actionpackRubyGems |
6.1.0 up to 6.1.7.8, plus listed versions 6.1.16.1.26.1.2.16.1.36.1.3.1 Show 21 moreShow less6.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.26.1.7.36.1.7.46.1.7.56.1.7.66.1.7.7 |
6.1.7.8 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
7.0.0 up to 7.0.8.4, plus listed versions 7.0.17.0.27.0.2.17.0.2.27.0.2.3 Show 17 moreShow less7.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.0.8.3 |
7.0.8.4 |
actionpackRubyGems |
7.1.0 up to 7.1.3.4, plus listed versions 7.1.17.1.27.1.37.1.3.17.1.3.27.1.3.3 |
7.1.3.4 |
actionpackRubyGems |
7.2.0.beta1 up to 7.2.0.beta2 | 7.2.0.beta2 |
rubygem-actionpackopenEuler:22.03-LTS-SP1 |
before 6.1.4.1-5.oe2203sp1 | 6.1.4.1-5.oe2203sp1 |
rubygem-actionpackopenEuler:22.03-LTS-SP3 |
before 6.1.4.1-5.oe2203sp3 | 6.1.4.1-5.oe2203sp3 |
rubygem-actionpackopenEuler:24.03-LTS |
before 7.0.7-3.oe2403 | 7.0.7-3.oe2403 |
rmt-serverSUSE:Linux Enterprise Module for Public Cloud 15 SP2 |
before 2.17-150200.3.45.1 | 2.17-150200.3.45.1 |
rmt-serverSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 2.17-150200.3.45.1 | 2.17-150200.3.45.1 |
rmt-serverSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 2.17-150200.3.45.1 | 2.17-150200.3.45.1 |
rmt-serverSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 2.17-150200.3.45.1 | 2.17-150200.3.45.1 |
rmt-serverSUSE:Linux Enterprise Module for Public Cloud 15 SP5 |
before 2.17-150500.3.16.1 | 2.17-150500.3.16.1 |
rmt-serverSUSE:Linux Enterprise Module for Public Cloud 15 SP6 |
before 2.17-150500.3.16.1 | 2.17-150500.3.16.1 |
rmt-serverSUSE:Linux Enterprise Module for Server Applications 15 SP5 |
before 2.17-150500.3.16.1 | 2.17-150500.3.16.1 |
rmt-serverSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.17-150500.3.16.1 | 2.17-150500.3.16.1 |
rmt-serveropenSUSE:Leap 15.5 |
before 2.17-150500.3.16.1 | 2.17-150500.3.16.1 |
rmt-serveropenSUSE:Leap 15.6 |
before 2.17-150500.3.16.1 | 2.17-150500.3.16.1 |
rmt-serverSUSE:Linux Enterprise Module for Public Cloud 15 SP4 |
before 2.17-150400.3.25.1 | 2.17-150400.3.25.1 |
rmt-serverSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.17-150400.3.25.1 | 2.17-150400.3.25.1 |
rmt-serverSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.17-150400.3.25.1 | 2.17-150400.3.25.1 |
rmt-serverSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.17-150400.3.25.1 | 2.17-150400.3.25.1 |
rmt-serverSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.17-150400.3.25.1 | 2.17-150400.3.25.1 |
rmt-serverSUSE:Manager Proxy 4.3 |
before 2.17-150400.3.25.1 | 2.17-150400.3.25.1 |
rmt-serverSUSE:Manager Server 4.3 |
before 2.17-150400.3.25.1 | 2.17-150400.3.25.1 |
rmt-serverSUSE:Linux Enterprise Module for Public Cloud 15 SP3 |
before 2.17-150300.3.37.1 | 2.17-150300.3.37.1 |
rmt-serverSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 2.17-150300.3.37.1 | 2.17-150300.3.37.1 |
rmt-serverSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 2.17-150300.3.37.1 | 2.17-150300.3.37.1 |
rmt-serverSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 2.17-150300.3.37.1 | 2.17-150300.3.37.1 |
rmt-serverSUSE:Enterprise Storage 7.1 |
before 2.17-150300.3.37.1 | 2.17-150300.3.37.1 |
railsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2 |
None known |
railsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2 |
None known |
railsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1 |
None known |
railsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1 |
None known |
railsUbuntu:24.04:LTS |
All versions, plus listed versions 2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3 |
None known |
railsUbuntu:25.10 |
All versions, plus listed versions 2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7 |
None known |
railsUbuntu:26.10 |
All versions, plus listed versions 2:7.2.3+dfsg-22:7.2.3.2+dfsg-2 |
None known |
railsUbuntu:26.04:LTS |
All versions, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2 |
None known |
rubygem-actionpack-7.0openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 7.0.8.4-1.1 | 7.0.8.4-1.1 |
rubygem-rails-7.0openSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 7.0.8.4-1.1 | 7.0.8.4-1.1 |
rmt-serveropenSUSE:Tumbleweed |
before 2.18-1.1 | 2.18-1.1 |
rubygem-actionpack-7.0openSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 7.0.8.6-1.3 | 7.0.8.6-1.3 |
rubygem-rails-7.0openSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 7.0.8.6-1.3 | 7.0.8.6-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28103 is a medium vulnerability (CVSS 5.4) in Rails, published June 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in actionpack 6.1.7.8.
References
github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7
security.netapp.com/advisory/ntap-20241206-0002
nvd.nist.gov/vuln/detail/CVE-2024-28103
Show 27 moreShow less
security-tracker.debian.org/tracker/CVE-2024-28103
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1708
suse.com/support/update/announcement/2024/suse-su-20241973-1
bugzilla.suse.com/1203171
ubuntu.com/security/CVE-2024-28103
cve.org/CVERecord?id=CVE-2024-28103
lists.opensuse.org/archives/list/[email protected]/thread/3C5WPU2RXUSPKAI3EANLIGCY34ZDBZ4Y