paperclip Server-Side Request Forgery vulnerability

严重 9.8CVE-2017-0889 · GHSA-5jcf-c5rg-rmm8 · Published 13/11/2017 · updated 17/06/2026

要点

CVE-2017-0889 是影响 paperclip, paperclip (thoughtbot) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：3.1%，高于 87.6% 的漏洞。
修复：升级到 5.2.0 或更高版本。

Package	Affected versions	Patched versions
paperclip RubyGems	`≥ 3.1.4, < 5.2.0`	`5.2.0`
paperclip thoughtbot	`≥ 3.1.4, < 5.2.0`	`5.2.0`

Description

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.

NVD description

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.

References

nvd.nist.gov/vuln/detail/CVE-2017-0889 · ADVISORY
thoughtbot/paperclip#2435 · WEB
hackerone.com/reports/209430 · WEB
hackerone.com/reports/713 · WEB
rubysec/ruby-advisory-db · WEB
thoughtbot/paperclip · PACKAGE

paperclip 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free