Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-38497 is a high-severity Insecure Preserved Inherited Permissions (CWE-278) vulnerability in Rust-Lang Cargo. Its CVSS base score is 7.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Cargo prior to version 0.72.2, bundled with Rust prior to 1.71.1, failed to respect the umask when extracting crate archives on UNIX-like systems. This flaw, tracked under CWE-278 and CWE-732, allowed downloaded crates containing files writable by any local user to retain overly permissive permissions in the local cache directory, typically ~/.cargo.
A local attacker on the same system could therefore modify source files within another user's extracted crate cache. When the victim subsequently built or ran a project depending on that crate, the attacker's changes would be compiled and executed with the victim's privileges, yielding a CVSS 7.9 impact that affects confidentiality and integrity but not availability.
The official GitHub Security Advisory and accompanying Cargo commit instruct users to upgrade to Rust 1.71.1 or later; the updated Cargo binary automatically purges caches created by older versions. As an immediate workaround, administrators can restrict permissions on the Cargo directory so that other local users cannot access it.
The associated EPSS score has remained low and stable near 0.0566 with a peak of 0.0580, indicating no significant post-disclosure exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2308
Vulnerability Data
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate…
more
containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Procedures support proper permission assignment for critical resources through documented controls.
Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.
Prevents overly permissive assignments to critical resources by limiting to task needs.
Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.
Training on permission management reduces incorrect permission assignments for critical resources.
Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.
Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.
Certification includes checking that permissions on critical resources are correctly assigned.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege permission policies and reviews directly prevents inheritance of insecure permissions from archives or copies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.1 only requires the existence of an overarching policy and topic-specific policies (including on access control); it does not itself enforce, implement, or act on permissions and therefore cannot stop CWE-732 from being exploitable.
A.5.12 only defines and communicates a classification scheme (with owners accountable for applying it); it does not itself enforce, restrict or decide any permissions, so the CWE-732 permission flaw can still be present and exploitable.
A.5.15 only requires defining a topic-specific access control policy and determining requirements; it does not itself enforce, implement, or act on those rules to stop exploitation of inherited insecure permissions (implementation lives in dependent controls such as A.8.3).
Managing access rights includes reviewing and adjusting permissions when objects are copied or inherited.
Documented responsibility for protecting assets encourages correct permission settings rather than leaving them at insecure defaults.
Monitoring supplier policy changes and conducting audits can reveal incorrect permission assignments on resources managed by the supplier, prompting corrective action before they are exploited.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.