CVE-2024-22049
Medium
Description
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Jnunemaker Httparty
PublishedJan 4, 2024
First seenJan 4, 2024
Weakness typeCWE-472CWE-472
How to fix
Update
- jnunemaker httparty0.21.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jnunemaker httparty | v < 0.21.0 | 0.21.0 |
| debian debian_linux | 10.0, 11.0 | — |
| fedoraproject fedora | 38, 39 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.