Medium severity · published Jun 7, 2018
CVE-2018-7689
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have…
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Open Build Service · Opensuse
before 2.9.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7689
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7689
bugzilla.suse.com
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689
github.com
https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43b
lists.opensuse.org
https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
More from Open Build Service
9.8
CVE-2011-4183
A vulnerability in open build service allows remote attackers to upload arbitrary RPM files
9.8
CVE-2014-0593
The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS)
8.8
CVE-2022-21949
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations
8.8
CVE-2021-36777
A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form…
8.8
CVE-2014-0594
In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent