Open Build Service arbitrary package modification
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 1.2%
exploitation probability
1.2%top 35% of all CVEs
observed exploitation
nono source reports it
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Affected products
openSUSE · Open Build Service