CVE-2021-21305 | Vulnetix

CVE-2021-21305 PUBLISHED CVSS 7.400000095367432 HIGH

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.

EPSS 12.68% · 96.0th percentile

Risk Scores

CVSS 3.1

7.400000095367432

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS Score

12.68%

96.0th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:18.04:LTS	ruby-carrierwave	0, 0.10.0+gh-4, 1.1.0-3
Ubuntu:16.04:LTS	ruby-carrierwave	*, 0, 0.10.0+gh-1
Ubuntu:Pro:20.04:LTS	ruby-carrierwave	1.3.1-2, 0

Timeline

Feb 8, 2021 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Oct 26, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Feb 28, 2022 EPSS Score
Apr 26, 2022 CVE Updated
May 2, 2022 EPSS Score
Jul 3, 2022 EPSS Score
Nov 7, 2022 EPSS Score
Jan 8, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2021-21305 third-party-advisory
https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08 third-party-advisory
https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08 third-party-advisory
https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7 third-party-advisory
https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4 third-party-advisory
https://rubygems.org/gems/carrierwave third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2021-21305 third-party-advisory
https://ubuntu.com/security/notices/USN-7497-1 vendor-advisory

Open in Interactive Console →