ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

보통 5.5CVE-2024-28862 · GHSA-x2h8-qmj4-g62f · Published 16/03/2024 · updated 17/06/2026

요약

CVE-2024-28862은(는) rotp, rotp (rotp project)에 영향을 주는 보통 (CVSS 5.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.18%, 전체 취약점의 7.2%보다 높음.
조치: 6.3.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
rotp RubyGems	`≥ 6.2.1, < 6.3.0`	`6.3.0`
rotp rotp_project	`≥ 6.2.1, < 6.3.0`	`6.3.0`

Description

The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions. Users should patch to version 6.3.0. Users unable to patch may correct file permissions after installation.

NVD description

References

mdp/rotp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-28862 · ADVISORY
mdp/rotp · PACKAGE
rubysec/ruby-advisory-db · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free