CVE-2024-29034: carrierwave_project carrierwave Cross-site Scripting
CVSS: 6.8v3.1MediumAnalyzed
AliasesCGA-22cm-x25c-625xCGA-2g3x-8mmj-jgj2CGA-2mr6-7xf9-vg2cCGA-3397-892m-8fqcCGA-33m4-r2ph-mxxfCGA-35r9-crq3-jhggCGA-39jh-hqgj-p8pqCGA-3fw3-jm78-x42vCGA-3w33-p5hr-m56rCGA-46m6-5p52-5qf4CGA-4q69-c6rc-fp4rCGA-4qmm-8hq8-3624CGA-4x5g-hx98-jjvmCGA-58mc-6qx2-73pvCGA-6h44-28qf-5p3vCGA-6j4g-9xvv-qvw5CGA-6rhm-v2wp-73m4CGA-6x3h-m3x3-2gw8CGA-75fq-vqmh-5j35CGA-7p6q-hvq8-chmmCGA-7v3f-x48c-hj92CGA-7v5x-xcxg-5v6cCGA-86hh-xp8q-2qf8CGA-88j4-j426-45vgCGA-8hjf-c4jv-5cjrCGA-8hx5-f9qq-22wcCGA-93c6-j534-x9chCGA-94h6-r4wv-8924CGA-9699-q686-9qx2CGA-97rg-vf24-h83vCGA-9p2v-mxfc-w3qpCGA-9xfx-mhwh-f6gqCGA-c2wr-ch34-2rh8CGA-c5qv-pg7f-73chCGA-cgvm-jvc9-gf65CGA-cv36-r55g-42vqCGA-fpc2-9pq8-f86cCGA-fqrm-j5wm-w545CGA-g59p-hp3v-hx6mCGA-g75j-cmrh-qfj4CGA-g99j-xh3v-f4gwCGA-g9fr-4wjm-2f8mCGA-gm4v-3j8w-qv2wCGA-h3c5-x5f8-6hcfCGA-j26x-mx36-v5qjCGA-j2gx-r877-hj82CGA-j43f-7xc2-m6cjCGA-jv38-vmr8-wjh8CGA-mg98-xf2q-f2fjCGA-mmhx-m5f4-fm3xCGA-mmjh-gm22-q4hvCGA-mrwv-6xg9-pp4jCGA-mwxp-64qp-jx9qCGA-p2fq-8h96-c74cCGA-p3h8-6q5g-5pv5CGA-p97x-3c8f-p3p6CGA-p9j4-h4qx-wvvqGHSA-vfmv-jfc5-pjjwCGA-q5jj-hw89-rgc7CGA-q9rv-75fx-3wjgCGA-qm24-jwhq-8q86CGA-qqj3-jv7w-x8pmCGA-r7wm-vv92-vrrxCGA-rfc4-wpg6-2gmpCGA-rfwm-r853-73wfCGA-rw47-wfjj-7c95CGA-rx9w-gjvm-h99qCGA-vvfr-7h7q-w6rpCGA-vw8r-4fjf-7727CGA-w28w-473w-qj33CGA-w55x-464q-xxp6CGA-wr8c-c7rx-qxg5CGA-wvm9-4x7j-4gmxCGA-wxh9-4vjw-64w9CGA-x282-xh9w-jpf9CGA-x3g3-cm6c-r9x3CGA-x6p5-mrjj-3c6hCGA-x995-hw7v-c5m6CGA-xq89-7c59-cmwjCGA-xv53-mrxf-gqffCGA-xvr2-c43m-wqj7CGA-2vj7-v94m-6vrxCGA-9f9j-x5cr-93m5CGA-xxrp-pjxv-j229CGA-8q8v-ph5j-pxxwCGA-cf33-rpg2-cchwCGA-jv54-vgj7-7657CGA-v4j7-x4m7-9gp8CGA-whjq-4243-v22x
Published 24-03-2024Last modified 02-08-2024
Vulnerability summary
CVE-2024-29034 is a medium (CVSS 6.8) Cross-site Scripting vulnerability in carrierwave_project carrierwave. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.
CVSS score
6.8/10
010
Medium · v3.1 (CVE.org)EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 24-03-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 6.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:NSources4 sources · 6.1–6.8
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
- OSV · RubygemsEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 20-09-2026
20-09-202620-10-2026
EPSS score0.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Affected systems
Chainguard44 products
- commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-19.2All versions (No fix recorded)
- commercial-gitlab-rails-ee-19.3All versions (No fix recorded)
- commercial-gitlab-rails-ee-19.4All versions (No fix recorded)
- commercial-gitlab-rails-ee-19.5All versions (No fix recorded)
Carrierwave_project1 product
- carrierwave< 2.2.6 | ≥ 3.0.0, < 3.0.7
Carrierwaveuploader1 product
- carrierwave≥ 3.0.0, < 3.0.7 | < 2.2.6
RubyGems1 product
- carrierwave≥ 3.0.0, < 3.0.7 | < 2.2.6
4 vendors · 47 products
References
6 links- github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-vfmv-jfc5-pjjwX Refsource CONFIRMAdvisoryWEBPatchThird Party Advisory
- github.com/carrierwaveuploader/carrierwave/commit/25b1c800d45ef8e78dc445ebe3bd8a6e3f0a3477X Refsource MISCFIXWEBPatch
