Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2024-29034
6.8
MEDIUMCVSS v3
Published
March 24, 2024
Affected
2 projects
Assigned by
GitHub
Severity scale
010
Description
CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.
carrierwave
RubyGemsUpload files in your Ruby applications, map them to a range of ORMs, store them on different backends.
RubyGemsUpload files in your Ruby applications, map them to a range of ORMs, store them on different backends.< 2.2.6, >= 3.0.0, < 3.0.7NVD
carrierwaveuploader/carrierwave
GitHubClassier solution for file uploads for Rails, Sinatra and other Ruby web frameworks
GitHubClassier solution for file uploads for Rails, Sinatra and other Ruby web frameworks< 2.2.6, >= 3.0.0, < 3.0.7NVD