Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-13v2-p4fw-qkfj
Vulnerability ID VCID-13v2-p4fw-qkfj
Aliases CVE-2017-0889
GHSA-5jcf-c5rg-rmm8
Summary paperclip Server-Side Request Forgery vulnerability
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-0889.json
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2017-0889
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2017-0889
epss 0.00344 https://api.first.org/data/v1/epss?cve=CVE-2017-0889
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-5jcf-c5rg-rmm8
cvssv3.1 9.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paperclip/CVE-2017-0889.yml
generic_textual CRITICAL https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paperclip/CVE-2017-0889.yml
cvssv3.1 9.8 https://github.com/thoughtbot/paperclip
generic_textual CRITICAL https://github.com/thoughtbot/paperclip
cvssv3 9.8 https://github.com/thoughtbot/paperclip/pull/2435
cvssv3.1 9.8 https://github.com/thoughtbot/paperclip/pull/2435
generic_textual CRITICAL https://github.com/thoughtbot/paperclip/pull/2435
cvssv3.1 9.8 https://hackerone.com/reports/209430
generic_textual CRITICAL https://hackerone.com/reports/209430
cvssv3.1 9.8 https://hackerone.com/reports/713
generic_textual CRITICAL https://hackerone.com/reports/713
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2017-0889
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2017-0889
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-0889.json
https://api.first.org/data/v1/epss?cve=CVE-2017-0889
https://github.com/thoughtbot/paperclip
https://github.com/thoughtbot/paperclip/pull/2435
https://hackerone.com/reports/209430
https://hackerone.com/reports/713
1513542 https://bugzilla.redhat.com/show_bug.cgi?id=1513542
CVE-2017-0889 https://nvd.nist.gov/vuln/detail/CVE-2017-0889
CVE-2017-0889.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paperclip/CVE-2017-0889.yml
GHSA-5jcf-c5rg-rmm8 https://github.com/advisories/GHSA-5jcf-c5rg-rmm8
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-0889.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paperclip/CVE-2017-0889.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/thoughtbot/paperclip
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/thoughtbot/paperclip/pull/2435
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://hackerone.com/reports/209430
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://hackerone.com/reports/713
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-0889
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.57404
EPSS Score 0.00344
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:23:57.961013+00:00 GHSA Importer Import https://github.com/advisories/GHSA-5jcf-c5rg-rmm8 38.6.0