CVE-2018-7689

Published: Jun 7, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.

Affected (1)

Products: Opensuse: Open Build Service

Opensuse

1 product

Open Build Service

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Open Build Service	Before 2.9.3

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (6)

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689

Source: security@opentext.com

https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43b

Source: security@opentext.com

https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html

Source: security@opentext.com

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43b

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.