CVE-2014-0594: falha de alta gravidade em openSUSE Open Build Service
CSRF protection incorrectly disabled
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.8%
In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
openSUSE · Open Build ServiceCVEs relacionadas — openSUSE Open Build Service
No mesmo produto, das mais perigosas para as menos.
CVE-2018-12473LOWpath traversal in obs-service-tar_scmEPSS 1.8%CVE-2018-12479MEDIUMRequest controller allows to create requests with arbitrary request IDsEPSS 1.7%CVE-2018-12478MEDIUMobs-service-replace_using_package_version allows to specify arbitrary input filesEPSS 1.5%CVE-2018-12474MEDIUMCrafted service parameters allows to induce unexpected behaviour in obs-service-tar_scmEPSS 1.4%CVE-2020-8021MEDIUMunauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build ServiceEPSS 1.3%CVE-2018-7689HIGHOpen Build Service arbitrary package modificationEPSS 1.2%