CVE-2024-22049
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
A vulnerability in httparty before version 0.21.0 allows an attacker to manipulate filenames during multipart/form-data uploads. A remote, unauthenticated attacker can provide a crafted filename parameter, leading to the writing of attacker-controlled filenames.
Risk Assessment
The risk involves potential overwriting of existing files or writing malicious files on the system, which could lead to privilege escalation or execution of dangerous code.
Recommendation
Immediately update the httparty library to version 0.21.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.