PT-2018-4094 · Opensuse · Open Build Service Api

Adrian Schröter · Publicado 2018-06-08 · Atualizado 2019-10-09 · CVE-2013-3703

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Build Service API versions prior to 2.4.4

Description The issue concerns a missing write permission check in the controller of the Open Build Service API. This allows an authenticated attacker to modify user roles associated with packages and/or project meta data.

Recommendations For versions prior to 2.4.4, update to version 2.4.4 or later to resolve the issue.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

CWE-275

Identificadores relacionados

CVE-2013-3703

Produtos afetados

Open Build Service Api

Referências · 3

• https://github.com/openSUSE/open-build-service/commit/06ad7fdbdd7eb2fef8947d14c4cdd00d8f6387b1 · Nota
• https://bugzilla.suse.com/show_bug.cgi?id=828256 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3703 · Nota de Segurança