CVE-2018-12475: obs-service-download_files allows downloading from localhost or intranet hosts
Published Sep 1, 2020
·Updated
A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-downloadfiles of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service .
Affected Software
1 affected component
openSUSE Open Build Service
Event History
Sep 1, 2020
CVE Published
via MITRE·11:55 AM
Data Sourced
via MITRE·11:55 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-12475.
2
What is the description of this vulnerability?
This vulnerability allows authenticated users to generate HTTP requests against internal networks and potentially download exposed data.
3
What is the affected software?
The affected software is openSUSE Open Build Service.
4
What is the severity of this vulnerability?
The severity of this vulnerability is medium with a CVSS score of 5.4.
5
How can I fix this vulnerability?
To fix this vulnerability, patch openSUSE Open Build Service to the latest version available.