Skip to content

CVE-2013-3703 No write permission check in change_role command

MediumCVSS 6.5 EPSS 0.93%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.

Affected products

ProductAffected versionsFixed in
openSUSE open build service >= 2.4.0, < 2.4.4 2.4.4
openSUSE open build service < 2.4.4 2.4.4

References