CVE-2021-33473

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.

Published: Jun 2, 2022
Updated: May 9, 2024
CVE: CVE-2021-33473
GHSA: GHSA-fj34-jhjx-xmvv
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2:

Severity: Low
Score: 4.9
AV:N/AC:M/Au:S/C:P/I:P/A:N

CWEs:

CWE-88

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
dragonfly_project / dragonfly	1.3.0	1.3.0.x
dragonfly	-	1.4.0

https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5
https://github.com/markevans/dragonfly/issues/513
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dragonfly/CVE-2021-33473.yml
https://security.netapp.com/advisory/ntap-20220715-0004/

Vulnerability Database

CVE-2021-33473

Deep Security Visibility Without the Complexity