Description
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.
Scores
CVSS v3
5.3
EPSS
0.0119
EPSS Percentile
78.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-472
Status
published
Products (6)
debian/debian_linux
10.0
debian/debian_linux
11.0
fedoraproject/fedora
38
fedoraproject/fedora
39
jnunemaker/httparty
< 0.21.0
rubygems/httparty
0 - 0.21.0RubyGems
Published
Jan 04, 2024
Tracked Since
Feb 18, 2026