Open Build Service
CVE-2022-21949
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.
AnalysisAI
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13. Affected products include: Opensuse Open Build Service. Version information: prior to 2.10.13..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.
More in Open Build Service
View allOpen Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client bi
a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying craft
A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause a
A Improper Input Validation vulnerability in Open Build Service allows remote attackers to extract files from the system
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against project
openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed aut
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attacker
Share
External POC / Exploit Code
Leaving vuln.today