CVE-2014-0594: CSRF protection incorrectly disabled

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-08 · updated 2026-06-17
Weakness: CWE-352

Description

In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.

Affected products

openSUSE Open Build Service: before 2.4.6 — fixed in 2.4.6

How to fix

Upgrade to a fixed version: openSUSE Open Build Service 2.4.6. Check the vendor advisory for mitigations.

References

https://bugzilla.suse.com/show_bug.cgi?id=870606
https://github.com/openSUSE/open-build-service/commit/2188c059b67b82171d0e28ef59f77e62d22a09d8
https://bugzilla.suse.com/show_bug.cgi?id=870606
https://github.com/openSUSE/open-build-service/commit/2188c059b67b82171d0e28ef59f77e62d22a09d8

Get alerted when CVE-2014-0594 or the next vulnerability affects your stack