PT-2024-22612 · Ruby · Rotp

G-Rath · Published 2024-03-15 · Updated 2025-12-05 · CVE-2024-28862

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ROTP versions prior to 6.3.0

Description The Ruby One Time Password library (ROTP) is an open source library for generating and validating one time passwords. Affected versions had overly permissive default permissions.

Recommendations For versions prior to 6.3.0, users should patch to version 6.3.0. For users unable to patch, correct file permissions after installation.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-28862

GHSA-X2H8-QMJ4-G62F

Affected Products

Rotp

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28862.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rotp/CVE-2024-28862.yml · Exploit
• https://github.com/mdp/rotp/security/advisories/GHSA-x2h8-qmj4-g62f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x2h8-qmj4-g62f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28862 · Security Note
• https://github.com/mdp/rotp · Note
• https://twitter.com/CVEnew/status/1768787498443157624 · Twitter Post
• https://t.me/cveNotify/144912 · Telegram Post
• https://t.me/cvenotify/73998 · Telegram Post
• https://twitter.com/it_malibu/status/1769934713815482856 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1768877976765051094 · Twitter Post
• https://twitter.com/rubylandnews/status/1769911723358650717 · Twitter Post