CVE-2018-12475CWE-610

obs-service-download_files allows downloading from localhost or intranet hosts

Medium · published September 1, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service .

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00610 · 48.3th percentile
Weakness
CWE-610 · Externally Controlled Reference to a Resource in Another Sphere
Published
2020-09-01T11:55Z
EPSS history
Timeline
  • 01 SEP 11:55Z
    obs-service-download_files allows downloading from localhost or intranet hosts
    cvelistv5