CVE-2024-29034: falha de média gravidade em carrierwaveuploader carrierwave
CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.4%
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
carrierwaveuploader · carrierwaveCVEs relacionadas — carrierwaveuploader carrierwave
No mesmo produto, das mais perigosas para as menos.
CVE-2021-21305HIGHCode Injection vulnerability in CarrierWaveEPSS 13.2%CVE-2021-21288MEDIUMServer-side request forgery in CarrierWaveEPSS 1.2%CVE-2023-49090MEDIUMCarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSSEPSS 0.6%CVE-2026-44587MEDIUMCarrierWave has a denylisted_content_type bypass via Unescaped Regex MetacharactersEPSS 0.2%