CVE-2013-3703
No write permission check in change_role command
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
No write permission check in change_role command
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
- Record
CVE-2013-3703- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2013-3636
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
- Record
EUVD-2013-3636- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jw5v-mxm6-2753
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission...
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
- Record
GHSA-jw5v-mxm6-2753- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
NVD
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
- Record
CVE-2013-3703- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-862, CWE-275
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-3703 is a high vulnerability (CVSS 8.8) in Opensuse Open Build Service, published June 8, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. No source names a fixed version.