{"affected":[{"defaultStatus":"unaffected","ecosystem":"gem","packageName":"httparty","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThanOrEqual":"0.20.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"httparty","product":"httparty","source":"OSV GHSA-5pq7-52mg-hr42","vendor":"","versions":[{"status":"affected","version":"0.1.0","versionType":"RubyGems"},{"status":"affected","version":"0.1.1","versionType":"RubyGems"},{"status":"affected","version":"0.1.2","versionType":"RubyGems"},{"status":"affected","version":"0.1.3","versionType":"RubyGems"},{"status":"affected","version":"0.1.5","versionType":"RubyGems"},{"status":"affected","version":"0.1.6","versionType":"RubyGems"},{"status":"affected","version":"0.1.7","versionType":"RubyGems"},{"status":"affected","version":"0.1.8","versionType":"RubyGems"},{"status":"affected","version":"0.10.0","versionType":"RubyGems"},{"status":"affected","version":"0.10.1","versionType":"RubyGems"},{"status":"affected","version":"0.10.2","versionType":"RubyGems"},{"status":"affected","version":"0.11.0","versionType":"RubyGems"},{"status":"affected","version":"0.12.0","versionType":"RubyGems"},{"status":"affected","version":"0.13.0","versionType":"RubyGems"},{"status":"affected","version":"0.13.1","versionType":"RubyGems"},{"status":"affected","version":"0.13.2","versionType":"RubyGems"},{"status":"affected","version":"0.13.3","versionType":"RubyGems"},{"status":"affected","version":"0.13.4","versionType":"RubyGems"},{"status":"affected","version":"0.13.5","versionType":"RubyGems"},{"status":"affected","version":"0.13.6","versionType":"RubyGems"},{"status":"affected","version":"0.13.7","versionType":"RubyGems"},{"status":"affected","version":"0.14.0","versionType":"RubyGems"},{"status":"affected","version":"0.15.0","versionType":"RubyGems"},{"status":"affected","version":"0.15.1","versionType":"RubyGems"},{"status":"affected","version":"0.15.2","versionType":"RubyGems"},{"status":"affected","version":"0.15.3","versionType":"RubyGems"},{"status":"affected","version":"0.15.4","versionType":"RubyGems"},{"status":"affected","version":"0.15.5","versionType":"RubyGems"},{"status":"affected","version":"0.15.6","versionType":"RubyGems"},{"status":"affected","version":"0.15.7","versionType":"RubyGems"},{"status":"affected","version":"0.16.0","versionType":"RubyGems"},{"status":"affected","version":"0.16.1","versionType":"RubyGems"},{"status":"affected","version":"0.16.2","versionType":"RubyGems"},{"status":"affected","version":"0.16.3","versionType":"RubyGems"},{"status":"affected","version":"0.16.4","versionType":"RubyGems"},{"status":"affected","version":"0.17.0","versionType":"RubyGems"},{"status":"affected","version":"0.17.1","versionType":"RubyGems"},{"status":"affected","version":"0.17.3","versionType":"RubyGems"},{"status":"affected","version":"0.18.0","versionType":"RubyGems"},{"status":"affected","version":"0.18.1","versionType":"RubyGems"},{"status":"affected","version":"0.19.0","versionType":"RubyGems"},{"status":"affected","version":"0.19.1","versionType":"RubyGems"},{"status":"affected","version":"0.2.0","versionType":"RubyGems"},{"status":"affected","version":"0.2.1","versionType":"RubyGems"},{"status":"affected","version":"0.2.10","versionType":"RubyGems"},{"status":"affected","version":"0.2.2","versionType":"RubyGems"},{"status":"affected","version":"0.2.3","versionType":"RubyGems"},{"status":"affected","version":"0.2.4","versionType":"RubyGems"},{"status":"affected","version":"0.2.5","versionType":"RubyGems"},{"status":"affected","version":"0.2.6","versionType":"RubyGems"},{"status":"affected","version":"0.2.7","versionType":"RubyGems"},{"status":"affected","version":"0.2.8","versionType":"RubyGems"},{"status":"affected","version":"0.2.9","versionType":"RubyGems"},{"status":"affected","version":"0.20.0","versionType":"RubyGems"},{"status":"affected","version":"0.3.0","versionType":"RubyGems"},{"status":"affected","version":"0.3.1","versionType":"RubyGems"},{"status":"affected","version":"0.4.0","versionType":"RubyGems"},{"status":"affected","version":"0.4.1","versionType":"RubyGems"},{"status":"affected","version":"0.4.2","versionType":"RubyGems"},{"status":"affected","version":"0.4.3","versionType":"RubyGems"},{"status":"affected","version":"0.4.4","versionType":"RubyGems"},{"status":"affected","version":"0.4.5","versionType":"RubyGems"},{"status":"affected","version":"0.5.0","versionType":"RubyGems"},{"status":"affected","version":"0.5.1","versionType":"RubyGems"},{"status":"affected","version":"0.5.2","versionType":"RubyGems"},{"status":"affected","version":"0.6.0","versionType":"RubyGems"},{"status":"affected","version":"0.6.1","versionType":"RubyGems"},{"status":"affected","version":"0.7.0","versionType":"RubyGems"},{"status":"affected","version":"0.7.2","versionType":"RubyGems"},{"status":"affected","version":"0.7.3","versionType":"RubyGems"},{"status":"affected","version":"0.7.4","versionType":"RubyGems"},{"status":"affected","version":"0.7.6","versionType":"RubyGems"},{"status":"affected","version":"0.7.7","versionType":"RubyGems"},{"status":"affected","version":"0.7.8","versionType":"RubyGems"},{"status":"affected","version":"0.8.0","versionType":"RubyGems"},{"status":"affected","version":"0.8.1","versionType":"RubyGems"},{"status":"affected","version":"0.8.2","versionType":"RubyGems"},{"status":"affected","version":"0.8.3","versionType":"RubyGems"},{"status":"affected","version":"0.9.0","versionType":"RubyGems"},{"events":[{"introduced":"0"},{"fixed":"0.21.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2024-22049","cwes":["CWE-472"],"description":"httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.","epss":{"date":"2026-11-08","percentile":0.70423,"score":0.0129},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794146394911,"publishedAt":1704399542547,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e"},{"source":"CNA: VulnCheck","tags":["related"],"url":"https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/advisories/GHSA-5pq7-52mg-hr42"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42"},{"source":"CNA: VulnCheck","tags":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/"},{"source":"CNA: VulnCheck","tags":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/"},{"source":"CNA: VulnCheck","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42"},{"source":"ADP: CVE","tags":["patch","x_transferred"],"url":"https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e"},{"source":"ADP: CVE","tags":["related","x_transferred"],"url":"https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://github.com/advisories/GHSA-5pq7-52mg-hr42"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00011.html"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00043.html"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-5pq7-52mg-hr42"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-5pq7-52mg-hr42"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e"},{"kind":"fix","source":"ADP: CVE","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e"},{"kind":"fix","source":"OSV GHSA-5pq7-52mg-hr42","text":"httparty (RubyGems): OSV reports a fixed version 0.21.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-5pq7-52mg-hr42"}],"revision":"fc632dac6b0df4cb108dc825c2b98a3efb7fde933c0a1037a739514a5bc4ce6b","sources":[{"modifiedAt":1794146394911,"name":"CNA: VulnCheck","retrievedAt":1794146924276,"url":"https://www.cve.org/CVERecord?id=CVE-2024-22049"},{"modifiedAt":1783493577239,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146924711,"url":"https://osv.dev/vulnerability/GHSA-5pq7-52mg-hr42"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150527435,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-22049"}],"ssvc":{"assessedAt":1746835112687,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"httparty Multipart/Form-Data Request Tampering Vulnerability","updatedAt":1794150527435}