CVE-2018-12474CWE-20

Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm

Medium · published October 9, 2018

CVSS v3.0
5.4
EPSS
1%
Percentile
71.6
In the wild
Unconfirmed
What it is

Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to 51a17c553b6ae2598820b7a90fd0c11502a49106.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01363 · 71.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-10-09T13:00Z
EPSS history
Timeline
  • 09 OCT 13:00Z
    Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm
    cvelistv5