CVE-2018-7688highCWE-862

CVE-2018-7688: high-severity vulnerability in openSUSE Open Build Service

Open Build Service accepts arbitrary reviews

Published · Updated

Follow this CVE+ Monitor Open Build Service+ Monitor open-build-service

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 1.1%
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Affected products
openSUSE · Open Build Service
Related CVEs — openSUSE Open Build Service

In the same product, most dangerous first.

CVE-2018-12473LOWpath traversal in obs-service-tar_scmEPSS 1.8%CVE-2018-12479MEDIUMRequest controller allows to create requests with arbitrary request IDsEPSS 1.7%CVE-2018-12478MEDIUMobs-service-replace_using_package_version allows to specify arbitrary input filesEPSS 1.5%CVE-2018-12474MEDIUMCrafted service parameters allows to induce unexpected behaviour in obs-service-tar_scmEPSS 1.4%CVE-2020-8021MEDIUMunauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build ServiceEPSS 1.3%CVE-2018-7689HIGHOpen Build Service arbitrary package modificationEPSS 1.2%