Description

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

Remediation

References

CVE-2024-28103

Related Vulnerabilities

WordPress Plugin iPanorama 360 WordPress Virtual Tour Builder Cross-Site Scripting (1.6.21)

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-1410)

WordPress Plugin Sooqr Search Restricted File Upload (1.1.4)

WordPress Plugin CataBlog 'category' Parameter Cross-Site Scripting (1.6.2)

WordPress Plugin WP-Recall-Registration, Profile, Commerce & More SQL Injection (16.26.5)

Severity

Critical

Classification

CVE-2024-28103 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities