CVE-2017-9268 MEDIUM

CVE-2017-9268: open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions

Vendor Suse
Product open build service
Weakness CWE-285
Published March 1, 2018
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).

Key dates

02Disclosure timeline

March 1, 2018 CVE published
September 17, 2024 Record updated