Open Build Service
CVE-2018-7688
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
AnalysisAI
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions. Affected products include: Opensuse Open Build Service. Version information: before 2.9.3.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.
More in Open Build Service
View allOpen Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client bi
a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying craft
A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause a
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against project
openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed aut
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attacker
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today