Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2018-7689

Open Build Service arbitrary package modification

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
microfocus

Description

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openSUSE Open Build Service

  • unspecified to < 2.9.3affected

References