CVE detail
CVE-2024-22049
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 23.0 · diversity 16.5 · KEV 0.0 · OTX 0.0 · PoC 4.5
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
9 source links · newest first
No excerpt available.
Vendor Advisorylists.debian.orgJan 4, 2024, 9:15 PMNo excerpt available.
Exploitvulncheck.comJan 4, 2024, 9:15 PM- https://lists.fedoraproject.org/archives/list/[email protected]/message/IOWECZPJY6JZIA5FSBJR77KCRDXWDZDA/lists.fedoraproject.org
No excerpt available.
Third Party Advisorylists.fedoraproject.orgJan 4, 2024, 9:15 PM - https://lists.fedoraproject.org/archives/list/[email protected]/message/4LDGAVPR4KB72V4GGQCWODEAI72QZI3V/lists.fedoraproject.org
No excerpt available.
Third Party Advisorylists.fedoraproject.orgJan 4, 2024, 9:15 PM No excerpt available.
Vendor Advisorylists.debian.orgJan 4, 2024, 9:15 PMNo excerpt available.
Exploitgithub.comJan 4, 2024, 9:15 PMNo excerpt available.
Exploitgithub.comJan 4, 2024, 9:15 PMNo excerpt available.
Exploitgithub.comJan 4, 2024, 9:15 PMNo excerpt available.
Exploitgithub.comJan 4, 2024, 9:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
1 repository references · best confidence 0.90 · max 0 stars
- jnunemaker/httpartyHigh confidencegithubNVD Exploit reference0 starsDiscovered Jul 15, 2026, 12:10 AM
NVD labels the source link as Exploit; this is not independent verification of the repository's code.
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2022-30597CVSS 5.3 · Medium
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
- CVE-2020-1765CVSS 3.5 · Low
An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOu…
- CVE-2024-35947CVSS 5.5 · Medium
In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't r…
- CVE-2024-3044CVSS 6.5 · Medium
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-int…
- CVE-2024-32465CVSS 7.3 · High
Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clea…
- CVE-2024-32021CVSS 3.9 · Low
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via t…