VULNERABILITY INTELLIGENCE
CVE-2024-22049
CVSS score5.3 MEDIUM
EPSS probability1.29%
CISA KEVNot currently listed
Published2024-01-04
Last modified2026-07-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.
Weakness classification
- disclosure@vulncheck.com: CWE-472
Primary references
- disclosure@vulncheck.com — Exploit, Third Party Advisory
- disclosure@vulncheck.com — Exploit
- disclosure@vulncheck.com — Patch
- disclosure@vulncheck.com — Exploit, Patch, Vendor Advisory
- disclosure@vulncheck.com — Mailing List, Third Party Advisory
- disclosure@vulncheck.com — Mailing List
- disclosure@vulncheck.com — Mailing List
- disclosure@vulncheck.com — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit
- af854a3a-2127-422b-91ae-364da2661108 — Patch
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Vendor Advisory