GitHub Advisoryadvisory · RubyGems

GHSA-6jvm-3j5h-79f6 paperclip Cross-site Scripting vulnerability

MEDIUM Published 2017-10-24 Modified 2023-01-23 Official page ↗
Aliases
CVE-2015-2963
Ecosystem
RubyGems
Packages
paperclip
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems paperclip: < 4.2.2 → fixed in 4.2.2

Description

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.

Related

Alias · CVE (1)

  • CVE-2015-2963 The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References