VDB
CVE-2023-49090
CVE-2023-49090
PUBLISHED
CVSS 6.800000190734863 MEDIUM
CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS
EPSS 0.14% · 34.1th percentile
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
EPSS Score
0.14%
34.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| carrierwaveuploader | carrierwave | >= 2.2.0, < 2.2.5, >= 3.0.0, < 3.0.5, >= 2.2.0, < 2.2.5 |
| carrierwave_project | carrierwave | 3.0.0, 0, 0 |
| RubyGems | carrierwave | 3.0.0, 0, 3.0.0 |
Exploit Intelligence
- CIRCL seen: CVE-2023-49090 (circl-sighting)
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj (circl)
- https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5 (circl)
- https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3 (circl)
- .bundler-audit.yml (github-poc)
- .bundler-audit.yml (github-poc)
- .bundler-audit.yml (github-poc)
- .bundler-audit.yml (github-poc)
- .bundler-audit.yml (github-poc)
- .bundler-audit.yml (github-poc)
…and 8 more exploits
Timeline
- Nov 29, 2023 CVE Published
- Nov 30, 2023 EPSS Score
- Dec 5, 2023 CVE Updated
- Dec 20, 2023 PoC Published
- Dec 30, 2023 EPSS Score
- Jan 28, 2024 EPSS Score
- Mar 28, 2024 EPSS Score
- Apr 26, 2024 EPSS Score
- May 26, 2024 EPSS Score
- Jun 25, 2024 EPSS Score
- Jul 25, 2024 EPSS Score
- Aug 23, 2024 EPSS Score
References
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj url
- https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5 url
- https://github.com/carrierwaveuploader/carrierwave/commit/863d425c76eba12c3294227b39018f6b2dccbbf3 url
- https://nvd.nist.gov/vuln/detail/CVE-2023-49090 advisory
- https://github.com/carrierwaveuploader/carrierwave package
- https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/uploader/content_type_allowlist.rb url
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2023-49090.yml url
- https://rubygems.org/gems/carrierwave/versions/2.2.5 url
- https://rubygems.org/gems/carrierwave/versions/3.0.5 url