CVE-2017-9268: opensuse open_build_service Improper Authorization
CVSS: 6.5v3.0MediumModified
AliasesUBUNTU-CVE-2017-9268DEBIAN-CVE-2017-9268
Published 01-03-2018Last modified 17-09-2024
Vulnerability summary
CVE-2017-9268 is a medium (CVSS 6.5) Improper Authorization vulnerability in opensuse open_build_service. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.6% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.0 (NVD)EPSS score
0.60%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 01-03-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSources4 sources · 4.4–6.5
- CVE.orgCNA4.4MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 18-09-2026
18-09-202618-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Debian1 product
- open-build-service< 2.9.4-1
Opensuse1 product
- open_build_service≤ 2.8.2
Suse1 product
- open build service≥ unspecified, < 20170722 git
Ubuntu1 product
- open-build-serviceAll versions (No fix recorded)
4 vendors · 4 products
References
5 links- github.com/openSUSE/open-build-service/pull/3267X Refsource CONFIRM
