CVE-2018-7688 HIGH

CVE-2018-7688: Open Build Service accepts arbitrary reviews

Vendor Opensuse

Product Open Build Service

Weakness CWE-862 · Missing authorization

Published June 7, 2018

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

What the vulnerability does

01Description

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.

Key dates

02Disclosure timeline

June 7, 2018 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-7688 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

CVE-2018-7688: Open Build Service accepts arbitrary reviews

01Description

02Disclosure timeline

03References

04Related CVE