Open Build Service
CVE-2018-12479
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionNVD
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are openSUSE Open Build Service: versions prior to 01b015ca2a320afc4fae823465d1e72da8bd60df.
AnalysisAI
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-20. A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are openSUSE Open Build Service: versions prior to 01b015ca2a320afc4fae823465d1e72da8bd60df. Affected products include: Opensuse Open Build Service. Version information: prior to 01.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Open Build Service
View allOpen Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client bi
a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers
A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause a
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against project
openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed aut
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attacker
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today