Vulnerability Description
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
CVSS Score
7.1
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Open Build Service | < 2.9.3 |
Related Weaknesses (CWE)
References
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689
- https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22
- https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689
- https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22
- https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
FAQ
What is CVE-2018-7689?
CVE-2018-7689 is a vulnerability with a CVSS score of 7.1 (HIGH). Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
How severe is CVE-2018-7689?
CVE-2018-7689 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-7689?
Check the references section above for vendor advisories and patch information. Affected products include: Opensuse Open Build Service.