Lucene search

MicrofocusCVE-2018-7688

HistoryJun 07, 2018 - 1:29 p.m.

CVE-2018-7688

2018-06-0713:29:00

CWE-862

microfocus

web.nvd.nist.gov

cve

2018

7688

opensuse

open build service

permission check

review handling

authenticated users

modify sources

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

30.9%

JSON

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.

Affected configurations

Nvd

Node

opensuseopen_build_serviceRange<2.9.3

VendorProductVersionCPE
opensuseopen_build_service*cpe:2.3:a:opensuse:open_build_service:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
opensuse	open_build_service	*	cpe:2.3:a:opensuse:open_build_service::::::::

CNA Affected

[
  {
    "product": "Open Build Service",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThan": "2.9.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7688

github.com/openSUSE/open-build-service/commit/b15cf19e9e01115f653c76ffdc8f54cd97566553

lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

30.9%

JSON

Related for CVE-2018-7688