Description (CNA)
A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| openSUSE / Open Build Service | affected unspecified before 2.9.3 |
CWE
CWE-862
References
- https://github.com/openSUSE/open-build-service/commit/b15cf19e9e01115f653c76ffdc8f54cd97566553
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7688
- https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
ADP enrichment
No English description supplied.