{"id":"CVE-2024-22049","aliases":[],"cve":{"records":[{"id":"CVE-2024-22049","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2024-01-04T18:44:53.108Z","published":"2024-01-04T20:19:02.547Z","modified":"2026-11-08T13:59:54.911Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T13:59:54.911Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2024-09-28T12:03:40.887Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2025-06-03T14:42:07.312Z"}],"references":[{"url":"https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43","tags":["related"],"source":"VulnCheck"},{"url":"https://github.com/advisories/GHSA-5pq7-52mg-hr42","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/","tags":[],"source":"VulnCheck"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/","tags":[],"source":"VulnCheck"},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html","tags":[],"source":"VulnCheck"},{"url":"https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42","tags":["vendor-advisory","x_transferred"],"source":"CVE"},{"url":"https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e","tags":["patch","x_transferred"],"source":"CVE"},{"url":"https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43","tags":["related","x_transferred"],"source":"CVE"},{"url":"https://github.com/advisories/GHSA-5pq7-52mg-hr42","tags":["third-party-advisory","x_transferred"],"source":"CVE"},{"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42","tags":["third-party-advisory","x_transferred"],"source":"CVE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/","tags":["x_transferred"],"source":"CVE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/","tags":["x_transferred"],"source":"CVE"},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html","tags":["x_transferred"],"source":"CVE"},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00043.html","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-472","description":"CWE-472 External Control of Assumed-Immutable Web Parameter","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:john_nunemaker:httparty:*:*:*:*:*:*:*:*","versionEndIncluding":"0.20.0","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2025-05-09T23:58:32.687393Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"httparty Multipart/Form-Data Request Tampering Vulnerability","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.","score":5.3,"severity":"medium","published":"2024-01-04T20:19:02.547Z","modified":"2026-11-08T13:59:54.911Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"httparty","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.20.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:gem/httparty","packageIdentity":{"ecosystem":"RubyGems","name":"httparty"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2024-22049"}],"remediation":[],"references":["https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42","https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e","https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43","https://github.com/advisories/GHSA-5pq7-52mg-hr42","https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/","https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00043.html"],"sources":[{"name":"CVE","id":"CVE-2024-22049","modified":"2026-11-08T13:59:54.911Z","url":"https://www.cve.org/CVERecord?id=CVE-2024-22049"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-08T14:06:07.341Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:35:32.718Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T09:40:34.491Z","attemptedAt":"2026-11-09T09:40:34.491Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T09:40:34.041Z","attemptedAt":"2026-11-09T09:40:34.041Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T09:40:33.778Z","attemptedAt":"2026-11-09T09:40:33.778Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T09:40:33.871Z","attemptedAt":"2026-11-09T09:40:33.871Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2023-0342","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0342","modified":"Nov 8, 2026, 1:59:54 PM","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-09T09:40:33.778Z"},{"source":"FIRST EPSS","id":"CVE-2024-22049","url":"https://www.first.org/epss/","probability":0.0129,"percentile":0.70423,"date":"2026-11-08","checkedAt":"2026-11-09T09:40:33.871Z"},{"source":"GitHub Advisory Database","id":"GHSA-5pq7-52mg-hr42","url":"https://github.com/advisories/GHSA-5pq7-52mg-hr42","modified":"2024-01-08T19:18:59Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","checkedAt":"2026-11-09T09:40:34.041Z"},{"source":"NVD","id":"CVE-2024-22049","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22049","modified":"2026-07-14T23:17:15.117","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-09T09:40:34.491Z"},{"source":"NVD","id":"CVE-2024-22049","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22049","modified":"2026-07-14T23:17:15.117","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-09T09:40:34.491Z"}],"aiSummary":{"text":"httparty before 0.21.0 is vulnerable to an external control of assumed-immutable web parameter weakness, allowing a remote and unauthenticated attacker to control filenames during multipart/form-data uploads. The attacker can provide a crafted filename parameter.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T17:06:14.694Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2024-22049"}]}}