CVE-2018-7688CWE-862

Open Build Service accepts arbitrary reviews

High · published June 7, 2018

CVSS v3.0
7.1
EPSS
1%
Percentile
65.2
In the wild
Unconfirmed
What it is

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.

The record
Technical detail
CVSS v3.0
7.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.01101 · 65.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2018-06-07T13:00Z
EPSS history
Timeline
  • 07 JUN 13:00Z
    Open Build Service accepts arbitrary reviews
    cvelistv5