Vulnerability · Published Oct 16, 2024 · Assigned by suse
CVE-2024-22033obs-service-download_url is vulnerable to argument injection
Medium 6.3
In plain English
A medium-severity OS command injection in openSUSE Leap 15.5 from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.9%top 39.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SUSE | SUSE Package Hub 15 SP5 | ? – before 0.2.1-bp155.3.3.1 |
| SUSE | SUSE Package Hub 15 SP6 | ? – before 0.2.1-bp156.2.3.1 |
| SUSE | openSUSE Leap 15.5 | ? – before 0.2.1-bp155.3.3.1 |
| SUSE | openSUSE Leap 15.6 | ? – before 0.2.1-bp156.2.3.1 |
| SUSE | openSUSE Tumbleweed | ? – before 0.2.1-1.1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L