CVE-2024-28862 ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.
Attackers can read or modify OTP files due to overly permissive default permissions, potentially bypassing authentication.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28862?
CVE-2024-28862 is a medium-severity vulnerability in mdp rotp, published on 15 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation.
Weakness: CWE-276
Which versions are affected by CVE-2024-28862?
2 open source packages ship an affected version, including rotp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rotp RubyGems | From 6.2.1 | 6.3.0 |
rotp RubyGems | From 6.2.1 | 6.3.0 |
Products include Rotp Project Rotp.
How do I fix CVE-2024-28862?
Upgrade rotp to 6.3.0 or later.
Is CVE-2024-28862 being exploited?
There is no known exploitation of CVE-2024-28862 in the wild and no public exploit code.
Sources
Also known as GHSA-x2h8-qmj4-g62f.