Information Exposure Affecting carrierwave package, versions <1.0.0.beta
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-CARRIERWAVE-20417
- published 14 Sep 2017
- disclosed 6 Apr 2014
- credit Manuel PRADAL
How to fix?
Upgrade carrierwave to version 1.0.0.beta or higher.
Overview
carrierwave provides a simple and extremely flexible way to upload files from Ruby applications.
Affected versions of the package are vulnerable to Information Exposure. When an exception message occurs, it contains the full path of the project directory.
References
CVSS Scores
version 3.1