CVE-2021-36777
High
Description
A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service login-proxy-scripts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef.
SeverityHigh
CVSS8.1
Exploit probability—
ProductOpensuse Open Build Service
PublishedMar 9, 2022
First seenMar 9, 2022
Weakness typeCWE-807CWE-807
How to fix
Update
- opensuse open_build_service2021-10-08 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opensuse open_build_service | v < 2021-10-08 | 2021-10-08 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.