Koji Project

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Koji Project records in CISA KEV

No Koji Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

3 records in Koji · all components

TI-2018-16131 CVE-2018-1002150 · GHSA-6mww-xvh7-fq4f

MEDIUM 43

Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.01658 Published 2018-04-04 Fixed in 1.15.1, 1.14.1 +2 CWE-732

TI-2019-12765 CVE-2019-17109 · GHSA-7498-c9fm-g64p

LOW 35

Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.03214 Published 2019-10-09 Fixed in 1.14.3, 1.15.3 +3 CWE-22

TI-2017-14760 CVE-2017-1002153 · GHSA-vwp5-w4rq-g4cc

LOW 35

Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01184 Published 2017-10-06 Fixed in 1.15.0 CWE-20