CVE-2024-54133
Possible Content Security Policy bypass in Action Dispatch
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Possible Content Security Policy bypass in Action Dispatch
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
- Record
CVE-2024-54133- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-3509
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
- Record
EUVD-2024-3509- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vfm5-rmrh-j26v
Possible Content Security Policy bypass in Action Dispatch
There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.
Impact
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.
Releases
The fixed releases are available at the normal locations.
Workarounds
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Credits
Thanks to ryotak for the report!
- Record
GHSA-vfm5-rmrh-j26v- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
- Record
CVE-2024-54133- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Possible Content Security Policy bypass in Action Dispatch
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
- Record
CVE-2024-54133- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-54133
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
- Record
DEBIAN-CVE-2024-54133- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 29 moreShow less
OSVGHSA-vfm5-rmrh-j26v
Possible Content Security Policy bypass in Action Dispatch
There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.
Impact
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.
Releases
The fixed releases are available at the normal locations.
Workarounds
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Credits
Thanks to ryotak for the report!
- Record
GHSA-vfm5-rmrh-j26v- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-54133
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
- Record
UBUNTU-CVE-2024-54133- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
OSVBIT-rails-2024-54133 No score
Possible Content Security Policy bypass in Action Dispatch
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
- Record
BIT-rails-2024-54133- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14668-1 No score
ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14668-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14669-1 No score
ruby3.4-rubygem-actionmailbox-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-actionmailbox-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14669-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14670-1 No score
ruby3.4-rubygem-actionmailer-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-actionmailer-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14670-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14671-1 No score
ruby3.4-rubygem-actionpack-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-actionpack-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14671-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14672-1 No score
ruby3.4-rubygem-actiontext-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-actiontext-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14672-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14673-1 No score
ruby3.4-rubygem-actionview-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-actionview-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14673-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14674-1 No score
ruby3.4-rubygem-activejob-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-activejob-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14674-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14675-1 No score
ruby3.4-rubygem-activemodel-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-activemodel-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14675-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14676-1 No score
ruby3.4-rubygem-activerecord-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-activerecord-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14676-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14677-1 No score
ruby3.4-rubygem-activestorage-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-activestorage-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14677-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14678-1 No score
ruby3.4-rubygem-activesupport-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-activesupport-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14678-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14679-1 No score
ruby3.4-rubygem-rails-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rails-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14679-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14680-1 No score
ruby3.4-rubygem-railties-8.0-8.0.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-railties-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14680-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10335-1 No score
ruby4.0-rubygem-actioncable-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-actioncable-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10335-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10336-1 No score
ruby4.0-rubygem-actionmailbox-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-actionmailbox-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10336-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10337-1 No score
ruby4.0-rubygem-actionmailer-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-actionmailer-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10337-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10338-1 No score
ruby4.0-rubygem-actionpack-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-actionpack-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10338-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10339-1 No score
ruby4.0-rubygem-actiontext-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-actiontext-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10339-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10340-1 No score
ruby4.0-rubygem-actionview-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-actionview-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10340-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10341-1 No score
ruby4.0-rubygem-activejob-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-activejob-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10341-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10342-1 No score
ruby4.0-rubygem-activemodel-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-activemodel-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10342-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10343-1 No score
ruby4.0-rubygem-activerecord-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-activerecord-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10343-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10344-1 No score
ruby4.0-rubygem-activestorage-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-activestorage-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10344-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10345-1 No score
ruby4.0-rubygem-activesupport-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-activesupport-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10345-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10360-1 No score
ruby4.0-rubygem-rails-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rails-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10360-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10362-1 No score
ruby4.0-rubygem-railties-8.0-8.0.3-1.3 on GA media
These are all security issues fixed in the ruby4.0-rubygem-railties-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10362-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
5.2.0 up to 7.0.8.7 | 7.0.8.7 |
actionpackRubyGems |
7.1.0 up to 7.1.5.1 | 7.1.5.1 |
actionpackRubyGems |
7.2.0 up to 7.2.2.1 | 7.2.2.1 |
actionpackRubyGems |
8.0.0 up to 8.0.0.1 | 8.0.0.1 |
railsBitnami |
5.2.0 up to 7.0.9, 7.1.0 up to 7.1.4, 7.2.0 up to 7.2.2-2-0, 8.0.0 up to 8.0.1 | 7.0.97.1.47.2.2-2-08.0.1 |
railsDebian:12 |
before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions 2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13 Show 10 moreShow less2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9 |
2:6.1.7.10+dfsg-1~deb12u1 |
railsDebian:13 |
before 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
railsDebian:14 |
before 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
railsDebian:11 From an advisory covering 8 CVEs |
before 2:6.0.3.7+dfsg-2+deb11u3, plus listed versions 2:6.0.3.7+dfsg-22:6.0.3.7+dfsg-2+deb11u12:6.0.3.7+dfsg-2+deb11u2 |
2:6.0.3.7+dfsg-2+deb11u3 |
railsDebian:12 From an advisory covering 9 CVEs |
before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions 2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13 Show 10 moreShow less2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9 |
2:6.1.7.10+dfsg-1~deb12u1 |
Show 37 moreShow less
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
5.2.0 up to 7.0.8.7, plus listed versions 5.2.15.2.1.15.2.1.rc15.2.25.2.2.1 Show 45 moreShow less5.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.2 |
7.0.8.7 |
actionpackRubyGems |
7.1.0 up to 7.1.5.1, plus listed versions 7.1.17.1.27.1.37.1.3.17.1.3.2 Show 6 moreShow less7.1.3.37.1.3.47.1.47.1.4.17.1.4.27.1.5 |
7.1.5.1 |
actionpackRubyGems |
7.2.0 up to 7.2.2.1, plus listed versions 7.2.17.2.1.17.2.1.27.2.2 |
7.2.2.1 |
railsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2 |
None known |
railsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2 |
None known |
railsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1 |
None known |
railsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1 |
None known |
railsUbuntu:24.04:LTS |
All versions, plus listed versions 2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3 |
None known |
railsUbuntu:25.10 |
All versions, plus listed versions 2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7 |
None known |
railsUbuntu:26.10 |
All versions, plus listed versions 2:7.2.3+dfsg-22:7.2.3.2+dfsg-2 |
None known |
railsUbuntu:26.04:LTS |
All versions, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2 |
None known |
rubygem-actioncable-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-actionmailbox-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-actionmailer-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-actionpack-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-actiontext-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-actionview-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-activejob-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-activemodel-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-activerecord-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-activestorage-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-activesupport-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-rails-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-railties-8.0openSUSE:Tumbleweed |
before 8.0.1-1.1 | 8.0.1-1.1 |
rubygem-actioncable-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-actionmailbox-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-actionmailer-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-actionpack-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-actiontext-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-actionview-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-activejob-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-activemodel-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-activerecord-8.0openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-activestorage-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-activesupport-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-rails-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
rubygem-railties-8.0openSUSE:Tumbleweed |
before 8.0.3-1.3 | 8.0.3-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-54133 is a low vulnerability (CVSS 2.3) in Rails, published December 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in actionpack 7.0.8.7.
References
github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
security.netapp.com/advisory/ntap-20250306-0010
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-54133
security-tracker.debian.org/tracker/CVE-2024-54133
ubuntu.com/security/CVE-2024-54133
cve.org/CVERecord?id=CVE-2024-54133
lists.opensuse.org/archives/list/[email protected]/thread/WYBFRW6P5ZJ3PZDVWOULBBATCQQTW7R6
suse.com/security/cve/CVE-2024-54133
Left out here: 73 versions. The JSON record has them.