CVE-2024-54133

mediumpriority · track · 0EPSS 0.010 · 63 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.00% (63rd) EPSS
CVSS 4.3 · medium
Is it mine?
33 products
Check your exposure
Who says so?
6 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedruby4.0-rubygem-actioncable-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actioncable-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actioncable-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actioncable-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionmailbox-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionmailbox-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionmailbox-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionmailbox-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionmailer-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionmailer-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionmailer-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionmailer-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionpack-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionpack-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionpack-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionpack-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actiontext-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actiontext-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actiontext-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actiontext-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionview-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionview-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionview-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-actionview-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activejob-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activejob-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activejob-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activejob-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activemodel-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activemodel-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activemodel-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activemodel-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activerecord-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activerecord-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activerecord-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activerecord-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activestorage-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activestorage-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activestorage-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activestorage-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activesupport-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activesupport-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activesupport-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-activesupport-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-rails-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-rails-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-rails-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-rails-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-railties-8.0-0:8.0.3-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-railties-8.0-0:8.0.3-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-railties-8.0-0:8.0.3-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Fixedruby4.0-rubygem-railties-8.0-0:8.0.3-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technical severity, 0–10. One row per scoring source.

4.3
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 0.6–4.3

v3.14.3mediumAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU
v4.02.3lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:Nsecondary · ENISA EU
v4.02.3lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com
v4.00.6lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79USCWE-79US
05

affected products (33)

Products and version ranges known to be affected.

showing 20 of 33
06

advisories (16)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2024-3665Ruby on Rails: Mehrere Schwachstellen ermöglichen Cross-Site ScriptingDeutsch2024-12-10csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

  • openSUSE-SU-2026:10335-1ruby4.0-rubygem-actioncable-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-actioncable-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10336-1ruby4.0-rubygem-actionmailbox-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-actionmailbox-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10337-1ruby4.0-rubygem-actionmailer-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-actionmailer-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10338-1ruby4.0-rubygem-actionpack-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-actionpack-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10339-1ruby4.0-rubygem-actiontext-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-actiontext-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10340-1ruby4.0-rubygem-actionview-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-actionview-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10341-1ruby4.0-rubygem-activejob-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-activejob-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10342-1ruby4.0-rubygem-activemodel-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-activemodel-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10343-1ruby4.0-rubygem-activerecord-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-activerecord-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10344-1ruby4.0-rubygem-activestorage-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-activestorage-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10345-1ruby4.0-rubygem-activesupport-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-activesupport-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10360-1ruby4.0-rubygem-rails-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-rails-8.0-8.0.3-1.3 on GA media

  • openSUSE-SU-2026:10362-1ruby4.0-rubygem-railties-8.0-8.0.3-1.3 on GA media2026-03-13csaf · suse_csafDE

    ruby4.0-rubygem-railties-8.0-8.0.3-1.3 on GA media

  • GHSA-vfm5-rmrh-j26vPossible Content Security Policy bypass in Action Dispatch2024-12-10ghsa · osvUS

    There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack. Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input. Credits ------- Thanks to [ryotak](https://hackerone.com/ryotak) for the report!

  • BIT-rails-2024-54133Possible Content Security Policy bypass in Action Dispatch2025-04-14vendor · osvUS

    Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

07

also known as (6)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundsuse_csafNVDCVE.orgMITRE
published 2024-12-10modified 2026-06-17
09

references (19)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan