CVE-2023-49090

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
carrierwaveuploader	carrierwave	>= 2.2.0, < 2.2.5; >= 3.0.0, < 3.0.5

References

Timeline

Published: Nov 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-490919.8Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Co CVE-2023-490925.9RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key i CVE-2023-490938.8HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker CVE-2023-490944.3Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator CVE-2023-490957.5nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate an CVE-2023-490968.8Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the Videos CVE-2023-490978.8ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to buil CVE-2023-490983.5Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exp CVE-2023-490994.3Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accesse CVE-2023-49105.5A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, t CVE-2023-491004.4Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is n CVE-2023-491016.1WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mi