CVE-2024-28862 — ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

CVE-2024-28862

ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files. PUBLISHED

Description (CNA)

The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation.

Affected (CNA)

Vendor / product	Versions
mdp / rotp	affected = 6.2.2; affected = 6.2.1

CWE

CWE-276

References

https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f

ADP enrichment

CVE

No English description supplied.

https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f

CISA-ADP

No English description supplied.

No references supplied.