CVE-2020-8021 — Improper Privilege Management in Open Build Service

CWE-269 — Improper Privilege Management5 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 59.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Opensuse Open Build ServiceDebian Linux
Timeline
PublishedMay 19
Latest updateMay 24

Description

a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5opensuse/open_build_serviceOpen Build Service — 2.10.5

Also affects: Debian Linux 9.0

Patches

Patch: bugzilla.suse.com ↗Patch: bugzilla.suse.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-4635-6x6c-c5r7: a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access↗2022-05-24
▶
CVEList
unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service↗2020-05-19
▶
OSV
CVE-2020-8021: a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access↗2020-05-19
▶

📋Vendor Advisories

1
Debian
CVE-2020-8021: open-build-service - a Improper Access Control vulnerability in of Open Build Service allows remote a...↗2020
▶
CVE-2020-8021 — Improper Privilege Management | cvebase