Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2018-12475— obs-service-download_files allows downloading from localhost or intranet hosts

Quick assessment

Affected
openSUSE Open Build Service
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Open Build Service（OBS）是一套通用的、以自动、一致和可重复的方式从源代码构建和分发软件包的系统。openSUSE是德国SUSE公司的一套基于Linux的自由操作系统与开源社区项目。 openSUSE Open Build service的obs-service-download_文件外部控制引用漏洞，攻击者通过身份验证的用户针对内部网络生成HTTP请求，并可能下载暴露敏感数据。

CVSS 6.5 · Medium EPSS 0.61% · P48
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2018-12475

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
obs-service-download_files allows downloading from localhost or intranet hosts
Source: CVE Program / CVE List V5
Vulnerability Description
A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service .
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
资源在另一范围的外部可控制索引
Source: CVE Program / CVE List V5
Vulnerability Title
Open Build Service和SUSE openSUSE 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Open Build Service（OBS）是一套通用的、以自动、一致和可重复的方式从源代码构建和分发软件包的系统。openSUSE是德国SUSE公司的一套基于Linux的自由操作系统与开源社区项目。 openSUSE Open Build service的obs-service-download_文件外部控制引用漏洞，攻击者通过身份验证的用户针对内部网络生成HTTP请求，并可能下载暴露敏感数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
openSUSE Open Build Service obs-service-download_files ~ 0.6.2 -

II. Public POCs for CVE-2018-12475

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2018-12475

请登录查看更多情报信息。

Vendor Advisories for CVE-2018-12475 (1)

IV. Related Vulnerabilities

Same product: Open Build Service
Same vendor: openSUSE
Same weakness: CWE-610

V. Comments for CVE-2018-12475

No comments yet

Leave a comment