CVE-2024-43791

2024-08-2315:15:16

CWE-276

GitHub_M

web.nvd.nist.gov

cve-2024-43791

requeststore

incorrect permissions

local users

arbitrary code

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.5%

JSON

RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.

Affected configurations

Nvd

Vulners

Node

steveklabnikrequest_storeMatch1.3.2

VendorProductVersionCPE
steveklabnikrequest_store1.3.2cpe:2.3:a:steveklabnik:request_store:1.3.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
steveklabnik	request_store	1.3.2	cpe:2.3:a:steveklabnik:request_store:1.3.2:::::::*

CNA Affected

[
  {
    "vendor": "steveklabnik",
    "product": "request_store",
    "versions": [
      {
        "version": "= 1.3.2",
        "status": "affected"
      }
    ]
  }
]