Description: CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
CVE-2021-21288
Published Date: 2021-02-08T20:15Z
Last Modified: 2021-02-12T16:30Z
CVSS Score: 4.3 (MEDIUM)
EPSS Score: 0.09%
Risk Score: 3.01 (MEDIUM)
Risk Score based on CVSS score and EPSS. This score is for reference purposes and is not internationally recognized.
CVSS:
4.3 |
EPSS:
0.09%
Mitre ATT&CK Technical v15.1
T1590.005 – IP Addresses
T1590.002 – DNS
T1071.004 – DNS
T1153 – Source
T1053.002 – At
Technical Analysis & Mitigation Measures
Reference Links
https://rubygems.org/gems/carrierwave/
https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211—2021-02-08
https://github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa304d1a665c0
https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5
https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132—2021-02-08
Vendor - Produce - Version
carrierwave - carrierwave_project, carrierwave - carrierwave_project
Disclaimer
The content on this website is automatically sourced from external websites such as the National Vulnerability Database (NVD), GitHub, and other security-related sources. This content is for reference purposes only, and we are not responsible for the accuracy or integrity of the information linked or displayed from these sources.