CVE-2021-33473

Published June 2nd, 2022

View on NVD ↗

CVSS v3

9.1

CRITICAL

CVSS v2

4.9

MEDIUM

Affected

PROJECT

Description

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.

markevans/dragonfly

A Ruby gem for on-the-fly processing - suitable for image uploading in Rails, Sinatra and much more!

GitHub

2.11K