CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LCarrierwave Project Carrierwave
APPCarrierwave Project< 1.3.22.0.1 – 2.1.1 (bez)
Related vulnerabilities
CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the c...
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability...
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a...
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby appli...