CVE-2018-7688
Published: 7 June 2018
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
open-build-service Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| lunar |
Not vulnerable
(2.9.4-4)
|
|
| mantic |
Not vulnerable
(2.9.4-4)
|
|
| noble |
Not vulnerable
(2.9.4-4)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(2.9.4-1)
|
|
| xenial |
Does not exist
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |