CVE-2013-3703 — No write permission check in change_role command
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from pack…
Published: 2018-06-08 · CVSS: 8.8 · CVSS 3.0
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7