CVSS 3.0
9.1 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2018-1002150
Critical (9.1) in koji project koji. EPSS 1.7% chance of exploitation in the next 30 days. Fixed in koji 1.12.1, 1.13.1, 1.14.1.
Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWE
- CWE-732
- Published
- Modified
- Record from
- the NVD, synced
Affected
- koji_project:koji
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6mww-xvh7-fq4f | PyPI | koji | >=1.15 <1.15.1 | 1.15.1 |
| GHSA-6mww-xvh7-fq4f | PyPI | koji | >=1.14 <1.14.1 | 1.14.1 |
| GHSA-6mww-xvh7-fq4f | PyPI | koji | >=1.13 <1.13.1 | 1.13.1 |
| GHSA-6mww-xvh7-fq4f | PyPI | koji | >=1.12 <1.12.1 | 1.12.1 |
| PYSEC-2018-86 | PyPI | koji | <1.15.1 | 1.15.1 |