CVE-2018-7689

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.

Score

CVSS 3.0 7.1 High

Status

Modified - security@opentext.com

Published

2018-06-07

Last modified

2024-09-16

Weaknesses

CWE-862

Affected products

• Open Build Service (Opensuse)

References

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689
• https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43b
• https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html