Vulnerability Description
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Carrierwave Project | Carrierwave | < 1.3.2 |
Related Weaknesses (CWE)
References
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132-Release NotesThird Party Advisory
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211-Release NotesThird Party Advisory
- https://github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa02PatchThird Party Advisory
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcmThird Party Advisory
- https://rubygems.org/gems/carrierwave/ProductThird Party Advisory
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132-Release NotesThird Party Advisory
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211-Release NotesThird Party Advisory
- https://github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa02PatchThird Party Advisory
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcmThird Party Advisory
- https://rubygems.org/gems/carrierwave/ProductThird Party Advisory
FAQ
What is CVE-2021-21288?
CVE-2021-21288 is a vulnerability with a CVSS score of 4.3 (MEDIUM). CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF v...
How severe is CVE-2021-21288?
CVE-2021-21288 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-21288?
Check the references section above for vendor advisories and patch information. Affected products include: Carrierwave Project Carrierwave.