CVE-2017-9268

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-285 CWE-732

Affected software

Vendor	Product	Versions
SUSE	open build service	>= unspecified, < 20170722 git

References

Timeline

Published: Mar 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-92699.8In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to sile CVE-2017-92709.1In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database.CVE-2017-92713.3The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxie CVE-2017-92727.5The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack.CVE-2017-92735.3The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes.CVE-2017-92747.8A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPE CVE-2017-92756.1NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack.CVE-2017-92766.1Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into th CVE-2017-92777.5The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections without CVE-2017-92789.8The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclos CVE-2017-92797.2NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User CVE-2017-92807.5Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposu