CVE-2017-9268 - Vulnerability Details - OpenCVE

In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Opensuse	Open Build Service

Configuration 1 [-]

cpe:2.3:a:opensuse:open_build_service:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=1045519
https://github.com/openSUSE/open-build-service/pull/3267

History

No history.

MITRE

Status: PUBLISHED

Assigner: microfocus

Published: 2018-03-01T19:00:00Z

Updated: 2024-09-17T00:50:30.039Z

Reserved: 2017-05-29T00:00:00

Link: CVE-2017-9268

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-03-01T20:29:00.757

Modified: 2024-11-21T03:35:43.413

Link: CVE-2017-9268

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "open build service", "vendor": "SUSE", "versions": [{"lessThan": "20170722 git", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Adrian Schr\u00f6ter of SUSE"}], "datePublic": "2017-06-22T00:00:00", "descriptions": [{"lang": "en", "value": "In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption)."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "incorrect permission checking lead to authenticated users to cause rebuilds or allowing wiping binaries in other projects.", "lang": "en", "type": "text"}]}, {"descriptions": [{"cweId": "CWE-285", "description": "CWE-285", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-06T16:15:48", "orgId": "f81092c5-7f14-476d-80dc-24857f90be84", "shortName": "microfocus"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1045519"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openSUSE/open-build-service/pull/3267"}], "source": {"advisory": "CVE-2017-9268", "defect": ["https://bugzilla.suse.com/show_bug.cgi?id=1045519"], "discovery": "INTERNAL"}, "title": "open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@microfocus.com", "DATE_PUBLIC": "2017-06-22T00:00:00.000Z", "ID": "CVE-2017-9268", "STATE": "PUBLIC", "TITLE": "open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "open build service", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_value": "20170722 git"}]}}]}, "vendor_name": "SUSE"}]}}, "credit": [{"lang": "eng", "value": "Adrian Schr\u00f6ter of SUSE"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption)."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "incorrect permission checking lead to authenticated users to cause rebuilds or allowing wiping binaries in other projects."}]}, {"description": [{"lang": "eng", "value": "CWE-285"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.suse.com/show_bug.cgi?id=1045519", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1045519"}, {"name": "https://github.com/openSUSE/open-build-service/pull/3267", "refsource": "CONFIRM", "url": "https://github.com/openSUSE/open-build-service/pull/3267"}]}, "source": {"advisory": "CVE-2017-9268", "defect": ["https://bugzilla.suse.com/show_bug.cgi?id=1045519"], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T17:02:43.626Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1045519"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/openSUSE/open-build-service/pull/3267"}]}]}, "cveMetadata": {"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84", "assignerShortName": "microfocus", "cveId": "CVE-2017-9268", "datePublished": "2018-03-01T19:00:00Z", "dateReserved": "2017-05-29T00:00:00", "dateUpdated": "2024-09-17T00:50:30.039Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:open_build_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "22C62CDA-5803-482D-8D18-C40C4E95A41C", "versionEndIncluding": "2.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption)."}, {"lang": "es", "value": "En open build service, en versiones anteriores a la 201707022, las acciones wipetrigger y rebuild comprobaban el proyecto equivocado en busca de permisos. Esto permit\u00eda que usuarios autenticados operasen en proyectos en los que no ten\u00edan permisos, lo que conduc\u00eda a una denegaci\u00f3n de servicio (consumo de recursos)."}], "id": "CVE-2017-9268", "lastModified": "2024-11-21T03:35:43.413", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "security@opentext.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-03-01T20:29:00.757", "references": [{"source": "security@opentext.com", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1045519"}, {"source": "security@opentext.com", "url": "https://github.com/openSUSE/open-build-service/pull/3267"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1045519"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/openSUSE/open-build-service/pull/3267"}], "sourceIdentifier": "security@opentext.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@opentext.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}