{"id":"CVE-2024-34528","aliases":["EUVD-2024-0212","GHSA-23qq-p4gq-gc2g","PYSEC-2024-175"],"status":"published","title":"WordOps has TOCTOU race condition","description":"WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00181,"percentile":0.07775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-367"],"published":"2024-05-05T00:00:00Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"PyPI","package":"wordops","fixed_in":["3.21.0","3.21.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"wordops","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"wordops","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.0"}]}],"versions":["3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.13.1","3.13.2","3.14.0","3.14.1","3.14.2","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.16.0","3.16.1","3.16.2","3.16.3","3.17.0","3.18.0","3.18.1","3.19.0","3.19.1","3.20.0","3.9.9.2","3.9.9.4"]},{"source":"osv","ecosystem":"PyPI","package":"wordops","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.3"}]}],"versions":["3.10.0","3.10.1","3.10.2","3.10.3","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.13.0","3.13.1","3.13.2","3.14.0","3.14.1","3.14.2","3.15.0","3.15.1","3.15.2","3.15.3","3.15.4","3.16.0","3.16.1","3.16.2","3.16.3","3.17.0","3.18.0","3.18.1","3.19.0","3.19.1","3.20.0","3.21.0","3.21.1","3.21.2","3.9.9.2","3.9.9.4"]}],"products":[{"vendor":"wordopsproject","product":"wordops"}],"references":[{"url":"https://github.com/WordOps/WordOps/issues/611","tags":["x_transferred","report","web"]},{"url":"https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34528","tags":["advisory"]},{"url":"https://github.com/WordOps/WordOps/commit/31353f0fef14ad8bc1f61c028971bd30b9e1909b","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/wordops/PYSEC-2024-175.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-23qq-p4gq-gc2g","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34528.json","tags":["advisory"]},{"url":"https://github.com/WordOps/WordOps","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-34528","description":"WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2024-11-01T18:43:19.803Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-0212","description":"WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2024-11-01T18:43:19Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:05:12.615767Z"}],"ghsa":[{"id":"GHSA-23qq-p4gq-gc2g","title":"WordOps has TOCTOU race condition","description":"WordOps through 3.20.0 has a `wo/cli/plugins/stack_pref.py` TOCTOU race condition because the `conf_path` `os.open` does not use a mode parameter during file creation.","status":"published","published":"2024-05-06T00:30:52Z","modified":"2025-01-21T18:28:28Z","cvss":[{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-362","CWE-367"],"updated_at":"2026-11-02T14:38:27.974809Z"}],"nvd":[{"id":"CVE-2024-34528","description":"WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.","status":"published","published":"2024-05-06T00:15:10.263Z","modified":"2026-06-17T07:33:34.32Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:09:56.122111Z"}],"osv":[{"id":"CVE-2024-34528","description":"WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2026-10-28T02:30:51.048171347Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-23qq-p4gq-gc2g","title":"WordOps has TOCTOU race condition","description":"WordOps through 3.20.0 has a `wo/cli/plugins/stack_pref.py` TOCTOU race condition because the `conf_path` `os.open` does not use a mode parameter during file creation.","status":"published","published":"2024-05-06T00:30:52Z","modified":"2025-01-21T18:36:27.337547Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":4.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-362","CWE-367"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"PYSEC-2024-175","description":"WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.","status":"published","published":"2024-05-06T00:15:10Z","modified":"2026-06-10T17:02:50.949879632Z","updated_at":"2026-11-02T15:52:53.837392Z"}]}}