Open Buildservice
Vendor:
First CVE: Mar 1, 2018 · Active for 8 years
23
Total CVEs
Bottom 1%
4.6
Avg CVEs / Year
Bottom 1%
7.3
Avg CVSS
Higher Avg CVSS than 63% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Open Buildservice over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 1, 2018
8 years ago
Most Recent CVE
May 3, 2022
1,543 days ago
CVE Severity & Scoring
Open Buildservice23 CVEs
48%
43%
9%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (4.3%)
Network22 (95.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low22 (95.7%)
High1 (4.3%)
Unknown0 (0.0%)
User Interaction
None18 (78.3%)
Unknown0 (0.0%)
Required5 (21.7%)
Privileges Required
Low11 (47.8%)
High0 (0.0%)
None12 (52.2%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (23 CVEs).
23 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-4183CRITICAL A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16. | Jun 13, 2018 | 9.8 | 30 | NO | NO |
CVE-2022-21949HIGH A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This | May 3, 2022 | 8.8 | 28 | NO | NO |
CVE-2011-3178HIGH In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode. | Mar 20, 2018 | 8.8 | 28 | NO | NO |
CVE-2021-36777HIGH A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form t | Mar 9, 2022 | 8.8 | 27 | NO | NO |
CVE-2014-0593CRITICAL The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly s | Jun 8, 2018 | 9.8 | 26 | NO | NO |
CVE-2018-12479HIGH A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are openSUSE Open Build Se | Oct 9, 2018 | 7.5 | 24 | NO | NO |
CVE-2018-12473HIGH A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself t | Oct 2, 2018 | 7.5 | 24 | NO | NO |
CVE-2011-4181HIGH A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up | Jun 11, 2018 | 7.5 | 24 | NO | NO |
CVE-2019-3685HIGH Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary | Nov 5, 2019 | 7.7 | 23 | NO | NO |
CVE-2018-12466MEDIUM openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links. | Aug 1, 2018 | 6.5 | 23 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (23 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (23 CVEs).
Media Mentions
Signals from CVEs in this product scope (23 CVEs).
Top CNAs Publishing CVEs For Open Buildservice
Top CWEs
Versions
No cataloged versions.