Vulnerabilities > CVE-2024-22049 - Exposure of Resource to Wrong Sphere vulnerability in John Nunemaker Httparty

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

john-nunemaker

CWE-668

NVD

Published: 2024-01-04

Updated: 2024-11-21

Summary

httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.

Vulnerable Configurations

Part	Description	Count
Application	John_Nunemaker John Nunemaker Httparty 0.1.0 John Nunemaker Httparty 0.1.1 John Nunemaker Httparty 0.1.2 John Nunemaker Httparty 0.1.3 John Nunemaker Httparty 0.1.5 John Nunemaker Httparty 0.1.6 John Nunemaker Httparty 0.1.7 John Nunemaker Httparty 0.1.8 John Nunemaker Httparty 0.2.0 John Nunemaker Httparty 0.2.1 John Nunemaker Httparty 0.2.2 John Nunemaker Httparty 0.2.3 John Nunemaker Httparty 0.2.4 John Nunemaker Httparty 0.2.5 John Nunemaker Httparty 0.2.6 John Nunemaker Httparty 0.2.7 John Nunemaker Httparty 0.2.8 John Nunemaker Httparty 0.2.9 John Nunemaker Httparty 0.2.10 John Nunemaker Httparty 0.3.0 John Nunemaker Httparty 0.3.1 John Nunemaker Httparty 0.4.0 John Nunemaker Httparty 0.4.1 John Nunemaker Httparty 0.4.2 John Nunemaker Httparty 0.4.3 John Nunemaker Httparty 0.4.4 John Nunemaker Httparty 0.4.5 John Nunemaker Httparty 0.5.0 John Nunemaker Httparty 0.5.1 John Nunemaker Httparty 0.5.2 John Nunemaker Httparty 0.6.0 John Nunemaker Httparty 0.6.1 John Nunemaker Httparty 0.7.0 John Nunemaker Httparty 0.7.1 John Nunemaker Httparty 0.7.2 John Nunemaker Httparty 0.7.3 John Nunemaker Httparty 0.7.4 John Nunemaker Httparty 0.7.5 John Nunemaker Httparty 0.7.6 John Nunemaker Httparty 0.7.7 John Nunemaker Httparty 0.7.8 John Nunemaker Httparty 0.8.0 John Nunemaker Httparty 0.8.1 John Nunemaker Httparty 0.8.2 John Nunemaker Httparty 0.8.3 John Nunemaker Httparty 0.9.0	46

Common Weakness Enumeration (CWE)

CWE-668 - Exposure of Resource to Wrong Sphere

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References