CVE-2015-0796CWE-434

open build service source server symlink exploitation via source patch

Medium · published March 2, 2018

CVSS v3.0
6.3
EPSS
1%
Percentile
57.9
In the wild
Unconfirmed
What it is

In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.

The record
Technical detail
CVSS v3.0
6.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00860 · 57.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2018-03-02T20:00Z
EPSS history
Timeline
  • 02 MAR 20:00Z
    open build service source server symlink exploitation via source patch
    cvelistv5