Read the docs
TI-2024-21844 Aliases CVE-2024-32978GHSA-7r3j-qmr4-jfpj

Kaminari Insecure File Permissions Vulnerability

Priority LOW 32CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified in the Kaminari pagination library for Ruby on Rails, concerning insecure file permissions. This vulnerability is of moderate severity due to the potential for unauthorized write access to particular Ruby files managed by the library. Such access could lead to the alteration of application behavior or data integrity issues. Users of affected versions are advised to update to Kaminari version 0.16.2 or later, where file permissions have been adjusted to enhance security. If upgrading is not feasible immediately, review and adjust the file permissions for particular Ruby files in Kaminari to ensure they are only accessible by authorized user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Fix Fixed kaminari (RubyGems): 0.16.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kaminarikaminari0.15.0 – 0.16.1—No fix listedCNA
—kaminari (RubyGems)0.15.0 to before 0.16.20.16.2Patch availableGHSA-7r3j-qmr4-jfpj
  • kaminari Vendorkaminari Affected 0.15.0 – 0.16.1 Fixed in — No fix listed CNA
  • kaminari (RubyGems) Vendor— Affected 0.15.0 to before 0.16.2 Fixed in 0.16.2 Patch available GHSA-7r3j-qmr4-jfpj

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:kaminari_project:kaminari:0.15.0:*:*:*:*:*:*:*0.15.0—Kaminari Project
  • cpe:2.3:a:kaminari_project:kaminari:0.15.0:*:*:*:*:*:*:* Versions 0.15.0 — ·Kaminari Project

Remediation

  • Fix · GHSA-7r3j-qmr4-jfpj kaminari (RubyGems) Fixed in 0.16.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32978
  2. 2026-10-03 Alias added: GHSA-7r3j-qmr4-jfpj

References

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences