CVE-2017-0889 - CVE House

Status published Critical CVE-2017-0889

Paperclip ruby gem version 3.1.4 and later suffers from a...

9.8 CVSS

Vulnerability Description

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-0889

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from thoughtbot

View All →

CVE-2020-5257

Sort order SQL injection in Administrate

High 7.7

CVE-2015-2963

The thoughtbot paperclip gem before 4.2.2 for Ruby does not...

Medium 4.3

CVE-2013-4457

The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent...

Medium 6.8

Affected Vendor

thoughtbot

View all reports →

Affected Software

paperclip ruby gem

Vulnerable Versions:

All versions since 3.1.4

Timeline

Official Publish: November 13th, 2017

Last Modified: September 16th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

Initial Access

T1213 Data from Information Repositories

Collection

T1005 Data from Local System