CVE-2018-12467CWE-285

delete package via link exploit in open buildservice

Medium · published August 1, 2018

CVSS v3.0
6.0
EPSS
1%
Percentile
50.0
In the wild
Unconfirmed
What it is

Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.

The record
Technical detail
CVSS v3.0
6.0 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00645 · 50.0th percentile
Weakness
CWE-285 · Improper Authorization
Published
2018-08-01T15:00Z
EPSS history
Timeline
  • 01 AUG 15:00Z
    delete package via link exploit in open buildservice
    cvelistv5