Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octopoller 0.3.0. Two workarounds are available. Users can use the previous version of the gem, v0.1.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
Published 2022-06-15 23:15:10
Updated 2022-06-27 18:17:08
Source GitHub, Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-31071

0.04%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-31071

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
2.1
LOW AV:L/AC:L/Au:N/C:N/I:P/A:N
3.9
2.9
NIST
3.3
LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1.8
1.4
NIST
2.5
LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1.0
1.4
GitHub, Inc.

CWE ids for CVE-2022-31071

  • During installation, installed file permissions are set to allow anyone to modify those files.
    Assigned by: security-advisories@github.com (Primary)

References for CVE-2022-31071

Products affected by CVE-2022-31071

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!