CVE-2024-22049 describes an assumed-immutable web parameter vulnerability (CWE-472) in httparty before version 0.21.0. A remote unauthenticated attacker can manipulate the filename parameter in multipart/form-data uploads, causing attacker-controlled filenames to be written. This could lead to integrity issues by overwriting or creating files with attacker-chosen names. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

The vulnerability allows an attacker to control filenames during file uploads, potentially leading to unauthorized file overwrites or creation. There is no direct impact on confidentiality or availability. The integrity of the system or application data may be compromised due to attacker-controlled filenames.

Upgrade httparty to version 0.21.0 or later where this vulnerability is fixed. Patch status is not explicitly confirmed in the provided data, but the vulnerability affects versions before 0.21.0, indicating that 0.21.0 includes the fix. No vendor advisory was provided to contradict this. Until upgrading, avoid processing untrusted multipart/form-data uploads or implement strict validation on filename parameters.