CVE-2018-7689: Open Build Service arbitrary package modification
Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-7689?
CVE-2018-7689 is a vulnerability in openSUSE Open Build Service before version 2.9.3 that allowed authenticated users to modify packages where they do not have write permissions.
How severe is CVE-2018-7689?
The severity of CVE-2018-7689 is high with a CVSS score of 6.5.
How can I fix CVE-2018-7689?
To fix CVE-2018-7689, it is recommended to update openSUSE Open Build Service to version 2.9.3 or later.
Where can I find more information about CVE-2018-7689?
You can find more information about CVE-2018-7689 on the bugzilla page (https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689), the GitHub commit (https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43b), and the openSUSE mailing list (https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html).
What is CWE-862?
CWE-862 is a vulnerability classification that refers to the weakness of not properly checking permissions.