What is CVE-2018-12474?

CVE-2018-12474 is a medium-severity vulnerability in openSUSE Open Build Service, classified under Improper Input Validation. CVSS score: 5.4/10. Published 2018-10-09.

How severe is CVE-2018-12474?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Improper input validation in openSUSE Open Build Service

CVE-2018-12474

Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to 51a17c553b6ae2598820b7a90fd0c11502a49106.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.014 (68.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Opensuse Open Build Service — versions unspecified
Opensuse Tar_scm

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

security@opentext.com (x_refsource_CONFIRM)
security@opentext.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2018-12474?: CVE-2018-12474 is a medium-severity vulnerability in openSUSE Open Build Service, classified under Improper Input Validation. CVSS score: 5.4/10. Published 2018-10-09.
How severe is CVE-2018-12474?: Medium severity. CVSS v3 base score is 5.4 out of 10.