VulnerableCode Advisory Details - gems/dragonfly/CVE-2021-33564

Staging Environment: Content and features may be unstable or change without notice.

Advisory details: ruby_advisory_db / gems/dragonfly/CVE-2021-33564

Essentials
Severities (1)
References (1)
Exploits (0)
EPSS
Severity details (0)
Patches: (0)

Advisory ID	ruby_advisory_db/gems/dragonfly/CVE-2021-33564
Aliases	CVE-2021-33564 GHSA-j858-xp5v-f8xx
Summary	Remote code execution in Dragonfly An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Status	Published
Exploitability	0.5
Weighted Severity	0.0
Risk
Affected and Fixed Packages	Package Details
Introduced and Fixed Package Commit Patches	Package Commit Patches Details

Weaknesses (0)

There are no known CWE.

System	Score	Found at
cvssv3	9.8

Reference id	Reference type	URL
		https://github.com/advisories/GHSA-j858-xp5v-f8xx

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.