CVE-2018-7688

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.

Score

CVSS 3.0 7.1 High

Status

Modified - security@opentext.com

Published

2018-06-07

Last modified

2024-09-16

Weaknesses

CWE-862

Affected products

• Open Build Service (Opensuse)

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7688
• https://github.com/openSUSE/open-build-service/commit/b15cf19e9e01115f653c76ffdc8f54cd97566553
• https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html