Lucene search

Server-side request forgery in CarrierWave

🗓️ 08 Feb 2021 19:26:16Reported by GitHub Advisory DatabaseType

Server-side request forgery in CarrierWave. Vulnerability in download feature allows SSRF attacks to gather internal network information

Reporter	Title	Published	Views	Family All 11
CVE	CVE-2021-21288	8 Feb 202120:15	–	cve
OSV	CVE-2021-21288	8 Feb 202120:15	–	osv
OSV	Server-side request forgery in CarrierWave	8 Feb 202119:16	–	osv
UbuntuCve	CVE-2021-21288	8 Feb 202100:00	–	ubuntucve
Prion	Design/Logic Flaw	8 Feb 202120:15	–	prion
NVD	CVE-2021-21288	8 Feb 202120:15	–	nvd
Debian CVE	CVE-2021-21288	8 Feb 202120:15	–	debiancve
Cvelist	CVE-2021-21288 Server-side request forgery in CarrierWave	8 Feb 202119:15	–	cvelist
RubySec	Server-side request forgery in CarrierWave	7 Feb 202121:00	–	rubygems
FreeBSD	Carrierwave -- Multiple vulnerabilities	8 Feb 202100:00	–	freebsd

Vulners

Node

carrierwave_project carrierwaveRange2.0.0–2.1.1

carrierwave_project carrierwaveRange<1.3.2

Source	Link
github	www.github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5
github	www.github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa304d1a665c0
github	www.github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md
github	www.github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md
rubygems	www.rubygems.org/gems/carrierwave/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21288
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2021-21288.yml
github	www.github.com/advisories/GHSA-fwcm-636p-68r5

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

08 Feb 2021 19:16Current

2.7Low risk

Vulners AI Score2.7

CVSS24

CVSS34.3

EPSS0.002

CWE-918