CVE-2023-38037

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current `umask` settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it. All users running an affected release should either upgrade or use one of the workarounds immediately.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Jan 9, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-380397.5When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. HoweveCVE-2023-38049.8A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability afCVE-2023-380406.1A reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..CVE-2023-380417.0A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flCVE-2023-380427.8A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEMCVE-2023-380437.8A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attackerCVE-2023-380449.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability allows SQL Injection.CVE-2023-380456.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for JoCVE-2023-380464.9A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specCVE-2023-380478.1A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of anCVE-2023-380488.1A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} allows a low privileged user to fetch, modify or delete a privileged user (CVE-2023-380498.1A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} allows a low privileged user to fetch, modify or delete an appointmen