CVE-2024-28862

ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

State: Published
Severity: 5.3 Medium
Published: Mar 15, 2024
Updated: Aug 21, 2024
Reserved: Mar 11, 2024

Description

The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
rotpmdp	= 6.2.2Affected = 6.2.1Affected

References

https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.