High severity · published Oct 2, 2018
CVE-2018-12473
A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to 70d1aa4cc4d7b940180553a63805c22fc62e2cf0.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Open Build Service · Opensuse
through 0.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-12473
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-12473
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=1105361
github.com
https://github.com/openSUSE/obs-service-tar_scm/pull/248
More from Open Build Service
9.8
CVE-2011-4183
A vulnerability in open build service allows remote attackers to upload arbitrary RPM files
9.8
CVE-2014-0593
The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS)
8.8
CVE-2022-21949
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations
8.8
CVE-2021-36777
A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form…
8.8
CVE-2014-0594
In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent