CVEvulnerability
CVE-2018-7688
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-06-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.1 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-862
Description
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
Affected configurations
• opensuse open build service (< 2.9.3)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7688 bugzilla.suse.com
- https://github.com/openSUSE/open-build-service/commit/b15cf19e9e01115f653c76ffdc8f54cd97566553 github.com
- https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html lists.opensuse.org
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7688 bugzilla.suse.com
- https://github.com/openSUSE/open-build-service/commit/b15cf19e9e01115f653c76ffdc8f54cd97566553 github.com
- https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html lists.opensuse.org