Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2018-12475

obs-service-download_files allows downloading from localhost or intranet hosts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
microfocus

Description

A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service .

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openSUSE Open Build Service

  • obs-service-download_files to ≤ 0.6.2affected

References