CVE-2018-1002150

moderate-risk
Published 2018-04-04

Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1.

Do I need to act?

-
0.30% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (4)

Koji
Koji
Koji
Koji

Affected Vendors

Koji Project

References (4)

Mitigation https://docs.pagure.org/koji/CVE-2018-1002150/
Third Party Advisory https://pagure.io/koji/issue/850
Mitigation https://docs.pagure.org/koji/CVE-2018-1002150/
Third Party Advisory https://pagure.io/koji/issue/850
42
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 1/34 · Minimal
Exposure 10/34 · Low