CVE-2024-22049

Katalog CVE

CVSS 5.3 · Medium EPSS 1,3%

Kerentanan External Control of Assumed-Immutable Web Parameter pada debian linux, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.

Rincian

Terbit di NVD

4 Januari 2024

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-472: External Control of Assumed-Immutable Web Parameter

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42 exploit · patch · advisory vendor
• https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e patch
• https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42 patch · advisory pihak ketiga
• https://github.com/advisories/GHSA-5pq7-52mg-hr42 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/09/msg00043.html mailing list · advisory pihak ketiga
• https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body... exploit
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5... mailing list