CVE-2017-0889

paperclip Server-Side Request Forgery vulnerability

9.8 CriticalFix available

CVE-2017-0889 is a critical vulnerability (CVSS 9.8) in Thoughtbot Paperclip, published November 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.05%, the 87th percentile. Fixed in paperclip 5.2.0.

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.05%Up 2.2 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2017-0889
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-918
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-0889
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2018-0152 No score

Record: EUVD-2018-0152
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5jcf-c5rg-rmm8 9.8

paperclip Server-Side Request Forgery vulnerability

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.

Record: GHSA-5jcf-c5rg-rmm8
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-918
Updated: 2026-11-02

OSV 9.8

Record: CVE-2017-0889
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-5jcf-c5rg-rmm8 9.8