open build service — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in open build service, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities for the open build service. The catalog collects confirmed security weaknesses associated with this product, covering advisories published over the recent years. You can track the vendor’s released security advisories, analyze recurring weakness classes, and review the product’s historical vulnerability data.

Vendor: SUSE

CVE ID	Title	CVSS	Severity	Published
CVE-2022-21949	Multiple XXE vulnerabilities in OBS CWE-611	8.8	High	2022-05-03
CVE-2020-8031	obs: Stored XSS CWE-79	6.3	Medium	2021-02-11
CVE-2018-12475	obs-service-download_files allows downloading from localhost or intranet hosts CWE-610	6.5	Medium	2020-09-01
CVE-2020-8021	unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service CWE-269	5.3	Medium	2020-05-19
CVE-2019-3685	Missing TLS certificate validation for HTTPS connections in osc CWE-295	7.4	High	2019-11-05
CVE-2018-12474	Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm CWE-20	8.8	-	2018-10-09
CVE-2018-12477	obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories CWE-93	6.5	-	2018-10-09
CVE-2018-12478	obs-service-replace_using_package_version allows to specify arbitrary input files CWE-20	6.5	-	2018-10-09
CVE-2018-12479	Request controller allows to create requests with arbitrary request IDs CWE-20	7.5	-	2018-10-09
CVE-2018-12473	path traversal in obs-service-tar_scm CWE-23	7.5	-	2018-10-02
CVE-2011-4183	open build service allows anyone to upload rpms CWE-862	9.8	-	2018-06-13
CVE-2011-4181	open build service information leak via unauthorized source access CWE-284	7.5	-	2018-06-11
CVE-2014-0594	CSRF protection incorrectly disabled CWE-352	8.8	-	2018-06-08
CVE-2013-3703	No write permission check in change_role command CWE-862	6.5	-	2018-06-08
CVE-2018-7688	Open Build Service accepts arbitrary reviews CWE-862	6.5	-	2018-06-07
CVE-2018-7689	Open Build Service arbitrary package modification CWE-862	6.5	-	2018-06-07
CVE-2015-0796	open build service source server symlink exploitation via source patch	7.7	-	2018-03-02
CVE-2017-5188	OBS worker VM escape via relative symbolic links	6.5	-	2018-03-01
CVE-2017-9268	open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions	6.5	-	2018-03-01

All 19 known CVE vulnerabilities affecting open build service with full Chinese analysis, references, and POCs where available.