CVE-2014-0594 CSRF protection incorrectly disabled
HighCVSS 8.8
EPSS 0.83%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openSUSE open build service | < 2.4.6 | 2.4.6 |
References
- bugzilla.suse.com
- github.com
- Debian Security Tracker CVE-2014-0594 vendor-advisory