What is CVE-2018-12477?

CVE-2018-12477 is a low-severity vulnerability in Opensuse Leap, classified under CRLF Injection. CVSS score: 3.5/10. Published 2018-10-09.

How severe is CVE-2018-12477?

Low severity. CVSS v3 base score is 3.5 out of 10.

Vulnerability in Opensuse Leap

CVE-2018-12477

A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Serv…

Vulnerability class: CRLF Injection

EPSS: 0.012 (63.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.

Affected products

Opensuse Leap — versions 15.0, 42.3
Opensuse Open Build Service — versions unspecified

Weakness classification (CWE)

CWE-93 — CRLF Injection

References

security@opentext.com (x_refsource_CONFIRM)
nvd@nist.gov (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2018-12477?: CVE-2018-12477 is a low-severity vulnerability in Opensuse Leap, classified under CRLF Injection. CVSS score: 3.5/10. Published 2018-10-09.
How severe is CVE-2018-12477?: Low severity. CVSS v3 base score is 3.5 out of 10.