Detections
Analytics

SCA: security update for octokit (GHSA-g28x-pgr3-qqx6)

low Tenable Cloud Security Plugin ID 414788

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published
 containing world-writeable files. Specifically, the gem was packed with files having their permissions set
 to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner
 (Group and Public) with access to the instance where this release had been installed could modify the
 world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are
 available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the
 file permissions manually until they are able to upgrade to the latest version. (CVE-2022-31072)

See Also

https://github.com/advisories/GHSA-g28x-pgr3-qqx6

Plugin Details

Severity: Low

ID: 414788

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2022-31072

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.9

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/15/2022

Vulnerability Publication Date: 6/15/2022

Reference Information

CVE: CVE-2022-31072

cwe: CWE-276