{"id":"CVE-2018-12466","published":"2018-08-01T15:00:00Z","modified":"2024-09-17T00:40:29Z","title":"openbuildservice allowed deleting packages via project links","vendor":"opensuse","product":"openbuildservice","tier":"tail","description":{"text":"openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00805,"percentile":0.56784,"provenance":"source"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"references":[{"url":"http://www.securityfocus.com/bid/104958","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://github.com/openSUSE/open-build-service/commit/f57b660f49f830006766a8d4abc3b4af6e178063","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-12466","tags":["x_refsource_CONFIRM"]}],"priority":{"score":14.4,"factors":[{"name":"EPSS percentile","points":11.36},{"name":"CVSS severity","points":3.08}]},"vendorSlug":"opensuse","affectedVersions":[{"vendor":"opensuse","product":"openbuildservice","versions":[">= unspecified, <= 2.9.4"]}],"euvd":{"id":"EUVD-2018-4436","exploited":false,"provenance":"source"}}