Arbitrary Command Execution Affecting dragonfly package, versions < 0.8.4
Threat Intelligence
EPSS
5.89% (94th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-DRAGONFLY-20109
- published 2 Sep 2013
- disclosed 2 Sep 2013
- credit Larry W. Cashdollar
Overview
dragonfly is a framework that enables on-the-fly processing for any content type. This gem was renamed from fog-dragonfly to dragonfly.
Affected versions of this gem are vulnerable to a remote attacker executing arbitrary commands, due to a failure to properly sanitize input passed via the imagemagickutils.rb script.
Related to SNYK-RUBY-DRAGONFLY-20108
CVSS Scores
version 3.1