CVE-2017-0889

Опубликовано: 13 нояб. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.

Ссылки

https://github.com/thoughtbot/paperclip/pull/2435
Issue Tracking
Patch
Third Party Advisory
https://hackerone.com/reports/209430
Permissions Required
https://hackerone.com/reports/713
Issue Tracking
Third Party Advisory
https://github.com/thoughtbot/paperclip/pull/2435
Issue Tracking
Patch
Third Party Advisory
https://hackerone.com/reports/209430
Permissions Required
https://hackerone.com/reports/713
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:thoughtbot:paperclip:*:*:*:*:*:ruby:*:*

Версия от 3.1.4 (включая) до 5.2.0 (исключая)

EPSS

Процентиль: 57%

0.00344

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-918

Связанные уязвимости

CVE-2017-0889

CVSS3: 4.3

redhat

почти 9 лет назад

GHSA-5jcf-c5rg-rmm8