In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
oryginał ENCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpensuse Open Build Service
APPOpensuse< 2.4.6
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Powiązane podatności
CVE-2022-21949HIGH8.8ten sam produkt
A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote...
CVE-2021-36777HIGH8.1ten sam produkt
A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build s...
CVE-2019-3685HIGH7.4ten sam produkt
Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc...
CVE-2011-4181HIGH7.5ten sam produkt
A vulnerability in open build service allows remote attackers to gain access to source files even though sourc...
CVE-2014-0593HIGH7.8ten sam produkt
The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Servic...