What is GHSA-fj34-jhjx-xmvv?

GHSA-fj34-jhjx-xmvv is a security advisory published by GitHub Security Advisories with Critical severity. Arbitrary file write in dragonfly

Which CVE IDs does GHSA-fj34-jhjx-xmvv cover?

GHSA-fj34-jhjx-xmvv covers the following CVE IDs: CVE-2021-33473. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fj34-jhjx-xmvv?

GHSA-fj34-jhjx-xmvv has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-fj34-jhjx-xmvv?

GHSA-fj34-jhjx-xmvv affects 1 product, including: rubygems/dragonfly:\u003c 1.4.0.

GHSA-fj34-jhjx-xmvvCriticalCVSS 9.1

Arbitrary file write in dragonfly

Vendor

GitHub Security Advisories

Published

June 3, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-33473 →

📋 Description

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.

🎯 Affected products1

rubygems/dragonfly:< 1.4.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-33473
https://github.com/markevans/dragonfly/issues/513
https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dragonfly/CVE-2021-33473.yml
https://security.netapp.com/advisory/ntap-20220715-0004/
https://github.com/advisories/GHSA-fj34-jhjx-xmvv