CVE-2021-21288: carrierwave_project carrierwave Server-Side Request Forgery (SSRF)
Vulnerability summary
CVE-2021-21288 is a medium (CVSS 4.3) Server-Side Request Forgery (SSRF) vulnerability in carrierwave_project carrierwave. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-02-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · RubygemsEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.17%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.17% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Carrierwave_project1 product
- carrierwave< 1.3.2 | ≥ 2.0.1, < 2.1.1
Carrierwaveuploader1 product
- carrierwave< 1.3.2 | ≥ 2.0.0, < 2.1.1
Debian1 product
- ruby-carrierwave< 1.3.2-1
RubyGems1 product
- carrierwave< 1.3.2 | ≥ 2.0.0, < 2.1.1
4 vendors · 4 products
References
10 links- github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5X Refsource CONFIRMWEBThird Party Advisory
- github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa304d1a665c0X Refsource MISCWEBPatchThird Party Advisory
- github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.mdX Refsource MISCWEBRelease NotesThird Party Advisory
- github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.mdX Refsource MISCWEBRelease NotesThird Party Advisory
