CVE-2023-38037
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
09/01/2025
Last modified:
15/02/2025
Description
ActiveSupport::EncryptedFile writes contents that will be encrypted to a<br />
temporary file. The temporary file&#39;s permissions are defaulted to the user&#39;s<br />
current `umask` settings, meaning that it&#39;s possible for other users on the<br />
same system to read the contents of the temporary file.<br />
<br />
Attackers that have access to the file system could possibly read the contents<br />
of this temporary file while a user is editing it.<br />
<br />
All users running an affected release should either upgrade or use one of the<br />
workarounds immediately.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM