GHSA-5jcf-c5rg-rmm8

Source

https://github.com/advisories/GHSA-5jcf-c5rg-rmm8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-5jcf-c5rg-rmm8/GHSA-5jcf-c5rg-rmm8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5jcf-c5rg-rmm8

Aliases

CVE-2017-0889

Published

2018-01-22T13:31:34Z

Modified

2023-11-08T03:58:40Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

paperclip Server-Side Request Forgery vulnerability

Details

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:16:31Z",
    "nvd_published_at":  "2017-11-13T17:29:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

RubyGems / paperclip

Package

Name: paperclip
Purl: pkg:gem/paperclip

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.1.4

Fixed

5.2.0

Affected versions

3.*

3.1.4

3.2.0

3.2.1

3.3.0

3.3.1

3.4.0

3.4.1

3.4.2

3.5.0

3.5.1

3.5.2

3.5.3

3.5.4

4.*

4.0.0

4.1.0

4.1.1

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

4.3.0

4.3.1

4.3.2

4.3.3

4.3.4

4.3.5

4.3.6

4.3.7

5.*

5.0.0.beta1

5.0.0.beta2

5.0.0

5.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/01/GHSA-5jcf-c5rg-rmm8/GHSA-5jcf-c5rg-rmm8.json"