Vulnerabilities

TI-2017-00837 CVE-2017-0889 · GHSA-5jcf-c5rg-rmm8

Server-side request forgery in thoughtbot paperclip ruby gem

MEDIUM 48

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03053 Published 2017-11-13 Partial fix · 5.2.0 CWE-918

TI-2015-02617 CVE-2015-2963 · GHSA-6jvm-3j5h-79f6

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type…

LOW 24

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) atta…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02106 Published 2015-07-10 Fixed in 4.2.2 CWE-79

Vulnerabilities

Filters

Server-side request forgery in thoughtbot paperclip ruby gem

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type…