UBUNTU-CVE-2021-21288: ruby-carrierwave Ubuntu
CVSS: 4.3v3.1MediumPublished
Published 08-02-2021Last modified 04-02-2026
Vulnerability summary
UBUNTU-CVE-2021-21288 is a medium (CVSS 4.3) vulnerability in ruby-carrierwave Ubuntu.
CVSS score
4.3/10
010
Medium · v3.1 (OSV · Ubuntu), selected by version preferenceEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-02-2021PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
CVSS metrics
1 score · 1 source · 1 versionMedium 4.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSourcesSingle source
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- ruby-carrierwaveAll versions (No fix recorded)
1 vendor · 1 product