CVE-2021-36777
Assigner: suse
Published: 2022-02-23T00:00:00
State: PUBLISHED
affected: product: Build service
vendor: openSUSE
versions: lessThan: dc000cdfe9b9b715fb92195b1a57559362f689ef
status: affected
version: login-proxy-scripts
versionType: custom
credits: value: Bernhard Wiedemann, Victor Pereira and Marcus Rueckert of SUSE
datePublic: 2022-02-23T00:00:00
descriptions: value: A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service login-proxy-scripts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-807
description: CWE-807: Reliance on Untrusted Inputs in a Security Decision
type: CWE
source: advisory: https://bugzilla.suse.com/show_bug.cgi?id=1191209
defect: 1191209
discovery: INTERNAL
title: login-proxy sends password to attacker-provided domain
x_generator: engine: Vulnogram 0.0.9