CVE-2014-0594 HIGH

CVE-2014-0594: CSRF protection incorrectly disabled

Vendor Opensuse

Product Open Build Service

Weakness CWE-352 · CSRF

Published June 8, 2018

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.

Key dates

02Disclosure timeline

June 8, 2018 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2014-0594 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2023-51407 WordPress Split Test For Elementor plugin <= 1.6.9 - Cross Site Request Forgery (CSRF) vulnerability CVE-2018-0413 CVE-2022-43980 Cross-site scripting vulnerability in the network maps edit functionality CVE-2026-3499 Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions CVE-2024-51659 WordPress Twitter @Anywhere Plus plugin <= 2.0 - CSRF to Stored XSS vulnerability