{"id":"CVE-2018-12467","published":"2018-08-01T15:00:00Z","modified":"2024-09-16T18:34:59Z","title":"delete package via link exploit in open buildservice","vendor":"opensuse","product":"openbuildservice","tier":"tail","description":{"text":"Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.","provenance":"source","from":"CVE.org"},"cvss":{"score":6,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00645,"percentile":0.50937,"provenance":"source"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"references":[{"url":"https://github.com/openSUSE/open-build-service/commit/f57b660f49f830006766a8d4abc3b4af6e178063","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1100217","tags":["x_refsource_CONFIRM"]}],"priority":{"score":14.4,"factors":[{"name":"EPSS percentile","points":10.19},{"name":"CVSS severity","points":4.2}]},"vendorSlug":"opensuse","affectedVersions":[{"vendor":"opensuse","product":"openbuildservice","versions":[">= unspecified, < 9.2.4"]}],"euvd":{"id":"EUVD-2018-4437","exploited":false,"provenance":"source"},"lineage":{"parents":[{"from":"CVE-2018-7689","to":"CVE-2018-12467","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.","from":"CVE.org","in":"CVE-2018-12467"}]}]}}