// For flags

CVE-2021-36777

login-proxy sends password to attacker-provided domain

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a expected login form that then sends the clear text credentials to an attacker specified server. This issue affects: openSUSE Build service login-proxy-scripts versions prior to dc000cdfe9b9b715fb92195b1a57559362f689ef.

Una vulnerabilidad Reliance on Untrusted Inputs in a Security Decision en el proxy de inicio de sesión del servicio openSUSE Build permitía a los atacantes presentar a los usuarios un formulario de inicio de sesión esperado que luego enviaba las credenciales en texto claro a un servidor especificado por el atacante. Este problema afecta a: openSUSE Build service login-proxy-scripts versiones anteriores a dc000cdfe9b9b715fb92195b1a57559362f689ef

*Credits: Bernhard Wiedemann, Victor Pereira and Marcus Rueckert of SUSE
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-07-19 CVE Reserved
  • 2022-03-09 CVE Published
  • 2024-09-16 CVE Updated
  • 2024-09-16 First Exploit
  • 2024-10-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-807: Reliance on Untrusted Inputs in a Security Decision
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://bugzilla.suse.com/show_bug.cgi?id=1191209 2024-09-16
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Opensuse
Search vendor "Opensuse"
 Open Build Service
Search vendor "Opensuse" for product "Open Build Service"
 < 2021-10-08
Search vendor "Opensuse" for product "Open Build Service" and version " < 2021-10-08"
-
Affected