PT-2024-25025 · Kaminari · Kaminari

G-Rath · Published 2024-05-27 · Updated 2024-05-28 · CVE-2024-32978

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaminari versions prior to 0.16.2

Description A security issue involving insecure file permissions has been identified in the Kaminari pagination library for Ruby on Rails. This issue is of moderate severity due to the potential for unauthorized write access to particular Ruby files managed by the library, which could lead to the alteration of application behavior or data integrity issues.

Recommendations For versions prior to 0.16.2, update to Kaminari version 0.16.2 or later, where file permissions have been adjusted to enhance security. If upgrading is not feasible immediately, manually adjust the file permissions on the server to restrict access, setting them to 644. Consider reviewing and adjusting the file permissions for particular Ruby files in Kaminari to ensure they are only accessible by authorized users.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-32978

GHSA-7R3J-QMR4-JFPJ

Affected Products

Kaminari

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32978.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kaminari/CVE-2024-32978.yml · Exploit
• https://osv.dev/vulnerability/GHSA-7r3j-qmr4-jfpj · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-32978 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-32978 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32978 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32978 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-32978 · Security Note
• https://github.com/kaminari/kaminari/security/advisories/GHSA-7r3j-qmr4-jfpj · Note
• https://github.com/kaminari/kaminari · Note
• https://t.me/cvenotify/81086 · Telegram Post
• https://t.me/cvenotify/81205 · Telegram Post