PT-2024-25950 · Wordops · Wordops

Nevercodecorrect · Published 2024-05-05 · Updated 2024-11-01 · CVE-2024-34528

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WordOps versions prior to 3.20.1

Description The issue is related to a TOCTOU race condition in the wo/cli/plugins/stack pref.py file. This occurs because the conf path os.open does not use a mode parameter during file creation, potentially allowing unauthorized access or modification of files.

Recommendations For WordOps versions prior to 3.20.1, update to version 3.20.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the wo/cli/plugins/stack pref.py file until a patch is available.

Fix

Race Condition

Time Of Check To Time Of Use

Weakness Enumeration

CWE-362

CWE-367

Related Identifiers

CVE-2024-34528

GHSA-23QQ-P4GQ-GC2G

PYSEC-2024-175

Affected Products

Wordops

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-34528 · Security Note
• https://osv.dev/vulnerability/GHSA-23qq-p4gq-gc2g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34528 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-175 · Vendor Advisory
• https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77 · Note
• https://github.com/WordOps/WordOps/issues/611 · Note
• https://github.com/WordOps/WordOps · Note
• https://github.com/WordOps/WordOps/commit/31353f0fef14ad8bc1f61c028971bd30b9e1909b · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/wordops/PYSEC-2024-175.yaml · Note
• https://twitter.com/CVEnew/status/1787561519179604166 · Twitter Post
• https://t.me/cvenotify/100348 · Telegram Post
• https://t.me/cvenotify/79165 · Telegram Post