CVE-2022-31071
low-risk
Published 2022-06-15
Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octopoller 0.3.0. Two workarounds are available. Users can use the previous version of the gem, v0.1.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
Do I need to act?
-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.5/10
Low
LOCAL
/ HIGH complexity
Affected Products (1)
Octopoller
Affected Vendors
References (4)
Third Party Advisory
https://github.com/octokit/octopoller.rb/security/advisories/GHSA-26qj-cr27-r5c4
Third Party Advisory
https://github.com/octokit/octopoller.rb/security/advisories/GHSA-26qj-cr27-r5c4
11
/ 100
low-risk
Severity
6/34 · Minimal
Exploitability
0/34 · Minimal
Exposure
5/34 · Minimal