CVE-2018-7688highCWE-862

CVE-2018-7688: fallo de gravedad alta en openSUSE Open Build Service

Open Build Service accepts arbitrary reviews

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Open Build Service+ Monitorear open-build-service

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 1.1%
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Productos afectados
openSUSE · Open Build Service
CVEs relacionadas — openSUSE Open Build Service

En el mismo producto, de las más peligrosas a las menos.

CVE-2018-12473LOWpath traversal in obs-service-tar_scmEPSS 1.8%CVE-2018-12479MEDIUMRequest controller allows to create requests with arbitrary request IDsEPSS 1.7%CVE-2018-12478MEDIUMobs-service-replace_using_package_version allows to specify arbitrary input filesEPSS 1.5%CVE-2018-12474MEDIUMCrafted service parameters allows to induce unexpected behaviour in obs-service-tar_scmEPSS 1.4%CVE-2020-8021MEDIUMunauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build ServiceEPSS 1.3%CVE-2018-7689HIGHOpen Build Service arbitrary package modificationEPSS 1.2%