PT-2018-4094 · Opensuse · Open Build Service Api

Adrian Schröter · Published 2018-06-08 · Updated 2019-10-09 · CVE-2013-3703

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Build Service API versions prior to 2.4.4

Description The issue concerns a missing write permission check in the controller of the Open Build Service API. This allows an authenticated attacker to modify user roles associated with packages and/or project meta data.

Recommendations For versions prior to 2.4.4, update to version 2.4.4 or later to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-275

Related Identifiers

CVE-2013-3703

Affected Products

Open Build Service Api

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-3703 · Security Note
• https://github.com/openSUSE/open-build-service/commit/06ad7fdbdd7eb2fef8947d14c4cdd00d8f6387b1 · Note
• https://bugzilla.suse.com/show_bug.cgi?id=828256 · Note