Vulnerability Description
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
CVSS Score
7.1
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Open Build Service | < 2.9.3 |
Related Weaknesses (CWE)
References
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7688
- https://github.com/openSUSE/open-build-service/commit/b15cf19e9e01115f653c76ffdc
- https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7688
- https://github.com/openSUSE/open-build-service/commit/b15cf19e9e01115f653c76ffdc
- https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
FAQ
What is CVE-2018-7688?
CVE-2018-7688 is a vulnerability with a CVSS score of 7.1 (HIGH). A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
How severe is CVE-2018-7688?
CVE-2018-7688 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-7688?
Check the references section above for vendor advisories and patch information. Affected products include: Opensuse Open Build Service.