HIGH🇬🇧 English

CVE-2022-21949

CVSS 8.8v3.1pub. 2022-05-03upd. 2024-11-21

A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Opensuse Open Build Service

    APP
    Opensuse
    < 2.10.13
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
XXE
CWE
Referencje

Powiązane podatności

CVE-2021-36777HIGH8.1ten sam produkt

A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build s...

CVE-2019-3685HIGH7.4ten sam produkt

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc...

CVE-2011-4181HIGH7.5ten sam produkt

A vulnerability in open build service allows remote attackers to gain access to source files even though sourc...

CVE-2014-0594HIGH8.8ten sam produkt

In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web in...

CVE-2014-0593HIGH7.8ten sam produkt

The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Servic...