CVE-2014-0594CWE-352

CSRF protection incorrectly disabled

High · published June 8, 2018

CVSS v3.0
8.8
EPSS
1%
Percentile
57.2
In the wild
Unconfirmed
What it is

In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00832 · 57.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2018-06-08T17:00Z
EPSS history
Timeline
  • 08 JUN 17:00Z
    CSRF protection incorrectly disabled
    cvelistv5