Detections
Analytics
SCA: security update for octopoller (GHSA-26qj-cr27-r5c4)
low Tenable Cloud Security Plugin ID 408746
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published
containing world-writeable files. Specifically, the gem was packed with files having their permissions set
to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner
(Group and Public) with access to the instance where this release had been installed could modify the
world-writable files from this gem. This issue is patched in Octopoller 0.3.0. Two workarounds are
available. Users can use the previous version of the gem, v0.1.0. Alternatively, users can modify the file
permissions manually until they are able to upgrade to the latest version. (CVE-2022-31071)
See Also
Plugin Details
Severity: Low
ID: 408746
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 6/1/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.1
Temporal Score: 1.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2022-31071
CVSS v3
Risk Factor: Low
Base Score: 3.3
Temporal Score: 2.9
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/15/2022
Vulnerability Publication Date: 6/15/2022
Reference Information
CVE: CVE-2022-31071
cwe: CWE-276