Vulnerability · Published Mar 9, 2022 · Assigned by suse

CVE-2021-36777login-proxy sends password to attacker-provided domain

High 8.1

In plain English

A high-severity security flaw in Build service from openSUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.9%top 39.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service login-proxy-scripts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef.

Affected products (as reported)

Vendor	Product	Versions
openSUSE	Build service	login-proxy-scripts – before dc000cdfe9b9b715fb92195b1a57559362f689ef

Weakness: CWE-807 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://bugzilla.suse.com/show_bug.cgi?id=1191209 x_refsource_CONFIRM