CVE-2024-43791: steveklabnik request store

csirt@kutim:~/threat-intel/cve/CVE-2024-43791

CVSS 7.8 · High EPSS 0,19%

Kerentanan Incorrect Default Permissions pada steveklabnik request store. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.

Rincian

Terbit di NVD: 23 Agustus 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-276: Incorrect Default Permissions
EPSS (30 hari): 0,19% peluang dieksploitasi; lebih tinggi dari 8,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
steveklabnik	request store	Versi 1.3.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.