Arbitrary Code Execution Vulnerability in RequestStore Rack (CVE-2017-1234)
CVE-2024-43791

7.8HIGH

Key Information:

Vendor

Steveklabnik

Status
Request Store
Vendor
CVE Published:
23 August 2024

What is CVE-2024-43791?

The RequestStore product by Steve Klabnik has a notable vulnerability due to the insufficient permissions set on its published files in version 1.3.2, which allow for world-writable access. This situation permits local users to execute arbitrary code, posing risks in environments where such access is available. Although this version was released in 2017 and most users have likely upgraded to more secure versions, awareness of this vulnerability is essential for maintaining secure production environments, particularly for those who might still be using the vulnerable version.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

request_store = 1.3.2

References

https://github.com/steveklabnik/request_store/security/ad...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.