Open Build Service
CVE-2018-12478
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs. Affected releases are openSUSE Open Build Service: status of is unknown.
AnalysisAI
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-20. A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system where the service runs. Affected releases are openSUSE Open Build Service: status of is unknown. Affected products include: Opensuse Open Build Service.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Open Build Service
View allOpen Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client bi
a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying craft
A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause a
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against project
openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed aut
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attacker
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today