CVE-2018-7689
published 2018-06-07CVE-2018-7689: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages…
PriorityP432medium6.5CVSS 3.0
AVNACLPRLUINSUCNIHAN
EPSS
1.21%
64.9th percentile
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | open-build-service | < open-build-service 2.9.4-1 (bookworm) | open-build-service 2.9.4-1 (bookworm) |
| opensuse | open_build_service | < 2.9.3 | 2.9.3 |
| opensuse | open_build_service | < 2.9.4 | 2.9.4 |
| opensuse | open_build_service | >= unspecified < 2.9.3 | 2.9.3 |
| opensuse | openbuildservice | >= unspecified < 9.2.4 | 9.2.4 |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv6.5MEDIUM
vendor_debian7.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-24pm-f3f4-m533: Authorized users of the openbuildservice before 2
ghsa_unreviewed·2022-05-13·CVSS 7.1
CVE-2018-12467 [HIGH] CWE-732 GHSA-24pm-f3f4-m533: Authorized users of the openbuildservice before 2
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
GHSA
GHSA-mcfv-wm6f-9ch2: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2
ghsa_unreviewed·2022-05-13
CVE-2018-7689 [MEDIUM] CWE-862 GHSA-mcfv-wm6f-9ch2: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
OSV
CVE-2018-12467: Authorized users of the openbuildservice before 2
osv·2018-08-01·CVSS 6.5
CVE-2018-12467 [MEDIUM] CVE-2018-12467: Authorized users of the openbuildservice before 2
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
OSV
CVE-2018-7689: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2
osv·2018-06-07·CVSS 6.5
CVE-2018-7689 [MEDIUM] CVE-2018-7689: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
Debian
CVE-2018-12467: open-build-service - Authorized users of the openbuildservice before 2.9.4 could delete packages by u...
vendor_debian·2018·CVSS 6.0
CVE-2018-12467 [MEDIUM] CVE-2018-12467: open-build-service - Authorized users of the openbuildservice before 2.9.4 could delete packages by u...
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
Scope: local
bookworm: resolved (fixed in 2.9.4-1)
sid: resolved (fixed in 2.9.4-1)
Debian
CVE-2018-7689: open-build-service - Lack of permission checks in the InitializeDevelPackage function in openSUSE Ope...
vendor_debian·2018·CVSS 7.1
CVE-2018-7689 [HIGH] CVE-2018-7689: open-build-service - Lack of permission checks in the InitializeDevelPackage function in openSUSE Ope...
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
Scope: local
bookworm: resolved (fixed in 2.9.4-1)
sid: resolved (fixed in 2.9.4-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43bhttps://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.htmlhttps://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43bhttps://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
2018-06-07
Published