CVE-2011-4181: open build service information leak via unauthorized source access

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-11 · updated 2026-06-16
Weakness: CWE-284

Description

A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 (for 2.1) and before version 2.3.

Affected products

openSUSE Open Build Service: from 2.1.0 before 2.1.16 — fixed in 2.1.16

How to fix

Upgrade to a fixed version: openSUSE Open Build Service 2.1.16. Check the vendor advisory for mitigations.

References

https://bugzilla.suse.com/show_bug.cgi?id=734003
https://github.com/openSUSE/open-build-service/commit/5281e4bff9df31f1f91e22a0d1e9086b93b23d7e
https://bugzilla.suse.com/show_bug.cgi?id=734003
https://github.com/openSUSE/open-build-service/commit/5281e4bff9df31f1f91e22a0d1e9086b93b23d7e

Get alerted when CVE-2011-4181 or the next vulnerability affects your stack