Riskcovery

CVE-2018-12474

Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm

State
Published
Severity
5.4 Medium
Published
Oct 9, 2018
Updated
Sep 16, 2024
Reserved
Jun 15, 2018

Read the record on cve.org

Description

Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to 51a17c553b6ae2598820b7a90fd0c11502a49106.

Scores

CVSSScoreVectorSource
3.05.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nmicrofocus

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
Open Build ServiceopenSUSE
  • before 51a17c553b6ae2598820b7a90fd0c11502a49106Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.