CVE-2021-21288 json
Server-side request forgery in CarrierWave
published 2021-02-08 5 y ago modified 2026-09-10 1 mo ago also GHSA-fwcm-636p-68r5 , EUVD-2021-0552
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
Patch / fix
- rubygems carrierwave 1.3.2, 2.1.1
- carrierwave_project carrierwave 1.3.2, 2.1.1
- ruby-carrierwave Debian 12 1.3.2-1
debian advisories DEBIAN-CVE-2021-21288
Exploit prediction
1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | carrierwave | <1.3.2 >=2.0.0, <2.1.1 |
1.3.2 2.1.1 |
Affected products
- carrierwaveuploader carrierwave
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa304d1a665c0
web, patch, third-party-advisory
-
github.com
/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5
web, third-party-advisory
-
rubygems.org
/gems/carrierwave/
product, third-party-advisory
-
github.com
/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08
web, release-notes, third-party-advisory
-
github.com
/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-21288
advisory
-
github.com
/carrierwaveuploader/carrierwave
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2021-21288.yml
web
-
rubygems.org
/gems/carrierwave
web
Sources
- CVE List CVE-2021-21288
- GitHub Advisory GHSA-fwcm-636p-68r5
- NVD CVE-2021-21288
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.