Vulnerability Details : CVE-2022-31072

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
Published 2022-06-15 23:15:10
Updated 2022-06-27 18:20:33
Source GitHub, Inc.
View at NVD,   CVE.org

Products affected by CVE-2022-31072

Exploit prediction scoring system (EPSS) score for CVE-2022-31072

EPSS FAQ
0.06%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 17 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-31072

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
2.1
 LOW AV:L/AC:L/Au:N/C:N/I:P/A:N
3.9
2.9
 NIST
3.3
 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
1.8
1.4
 NIST
2.5
 LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
1.0
1.4
 GitHub, Inc.

CWE ids for CVE-2022-31072

  • During installation, installed file permissions are set to allow anyone to modify those files.
    Assigned by: security-advisories@github.com (Primary)

References for CVE-2022-31072

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close