CVE-2022-31072

    Dashboard / Vulnerabilities / CVE-2022-31072

    CVE-2022-31072

    Published: 15 Jun 2022Last Modified: 12 Aug 2026

    Summary: Octokit gem published with world-writable files

    Details: Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31072.json, https://github.com/octokit/octokit.rb/security/advisories/GHSA-g28x-pgr3-qqx6, https://nvd.nist.gov/vuln/detail/CVE-2022-31072, https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- edd06795f77b95aeb02efcc52f588df7f600c02a
    Fixed -a73386bc32f7201c60963f46f107dc1ef67bf755

    Affected versions

    4.23.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31072 | CVE-DB