thoughtbot/paperclip

thoughtbot/paperclip

Releases103

Frequency1 month 6 days

Last Releasealmost 8 years ago

Stars9.02K

Easy file attachment management for ActiveRecord

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2017-0889NVD↗	>= 3.1.4, < 5.2.0	Nov 13, 2017Monday, 13 November 2017, 17:29	—	7.5 HIGH
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.
CVE-2015-2963NVD↗	<= 4.2.1, < 4.2.2	Jul 10, 2015Friday, 10 July 2015, 17:59	—	4.3 MEDIUM
The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.