{"action":"Upgrade actionpack to 6.1.7.8 or later.","affected":[{"fixed":"6.1.7.8","introduced":"6.1.0"},{"fixed":"7.0.8.4","introduced":"7.0.0"},{"fixed":"7.1.3.4","introduced":"7.1.0"},{"fixed":"7.2.0.beta2","introduced":"7.2.0.beta1"}],"component":"actionpack","cve_ids":["CVE-2024-28103"],"ecosystem":"RubyGems","epss":0.00658,"exploited":false,"fixed_versions":["6.1.7.8","7.0.8.4","7.1.3.4","7.2.0.beta2"],"ghsa_id":"GHSA-fwhr-88qx-h9g7","id":"tcs_01M5KEK5Y00PW8FAAW4AEGHD5P","modified_at":"2026-09-10T03:50:15.333571958Z","published_at":"2024-06-04T22:26:24Z","references":["https://osv.dev/vulnerability/GHSA-fwhr-88qx-h9g7","https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7","https://nvd.nist.gov/vuln/detail/CVE-2024-28103","https://github.com/rails/rails/commit/35858f1d9d57f6c4050a8d9ab754bd5d088b4523","https://github.com/rails/rails","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-28103.yml","https://security.netapp.com/advisory/ntap-20241206-0002"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-fwhr-88qx-h9g7","url":"https://osv.dev/vulnerability/GHSA-fwhr-88qx-h9g7"}],"summary":"Missing security headers in Action Pack on non-HTML responses"}