Vendors / The Cobbler Project Records 11 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 4
Exploited now The Cobbler Project records in CISA KEV No The Cobbler Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 84
Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.86829 · Published 2021-10-04 · Fixed in 3.3.0 CWE-94
Priority HIGH 79
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.68083 · Published 2018-08-09 · Fixed in 3.0.0 CWE-749
Priority HIGH 70
Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.68635 · Published 2021-10-04 · Fixed in 3.3.0 CWE-434
Priority MEDIUM 51
Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05556 · Published 2018-01-03 · Partial fix · 3.0.0 CWE-20
Priority MEDIUM 44
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02256 · Published 2022-03-11 · Fixed in 3.3.2 CWE-285
Priority LOW 36
Cobbler before 3.3.0 allows authorization bypass for modification of settings.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01406 · Published 2021-10-04 · Fixed in 3.3.0 CWE-863
Priority LOW 35
An issue was discovered in Cobbler before 3.3.1.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00495 · Published 2022-02-18 · Fixed in 3.3.1 CWE-77
Priority LOW 34
The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load func…
CVSS 2.0 MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.02192 · Published 2014-10-27 · Fixed in 2.6.0 CWE-20
Priority LOW 31
An issue was discovered in Cobbler before 3.3.1.
CVSS 3.1 HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00311 · Published 2022-02-20 · Fixed in 3.3.1 CWE-276
Priority LOW 29
An issue was discovered in Cobbler through 3.3.1.
CVSS 3.1 MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01052 · Published 2022-02-20 · No fix listed CWE-319
Priority LOW 29
A flaw was found in cobbler software component version 2.6.11-1.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00806 · Published 2018-08-22 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
4 4 3 0 0
THREATIST.IORead the docs