CVE-2018-1002150

Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access

published April 4, 2018

CVSS
—
EPSS
2%
Percentile
76.4
In the wild
Unconfirmed
What it is

⚠️ An authorization mishap means anyone can read or write files on Koji versions 1.12 to 1.15 — it's like having an open guestbook at a party where anyone can scribble anything they want! Think of it as a library that forgot to lock its rare books section. Without proper checks, anyone can waltz in and either borrow or deface the valuable tomes — a librarian's nightmare! This vulnerability allows an attacker to access sensitive files or modify existing ones, leading to data loss or corruption. If left unpatched, it could compromise the integrity of your entire system, potentially causing chaos. 🚨

Put simply

Think of it as a library that forgot to lock its rare books section. Without proper checks, anyone can waltz in and either borrow or deface the valuable tomes — a librarian's nightmare! Koji versions 1.12 through 1.15 have improper access control, allowing arbitrary read/write actions without proper user verification. This flaw can be exploited by unauthorized users to manipulate filesystem content arbitrarily.

What to do

This vulnerability allows an attacker to access sensitive files or modify existing ones, leading to data loss or corruption. If left unpatched, it could compromise the integrity of your entire system, potentially causing chaos. 🚨 Update Koji to versions 1.12.1, 1.13.1, 1.14.1, or 1.15.1 immediately to close this security gap. Additionally, conduct a thorough audit to ensure no unwanted access has occurred. 🛡️ Don't sweat it! This fix is straightforward, and with these updates, you're on your way to securing your system. You've got this! 💪

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01658 · 76.4th percentile
Published
2018-04-04T20:00Z
EPSS history
Timeline
  • 04 APR 20:00Z
    Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access
    cvelistv5