Read the docs
TI-2018-07743 Aliases CVE-2018-10931GHSA-8787-63px-3m23

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface…

Priority HIGH 79CWE-749Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.

Why it matters now

EPSS 0.68083 99th percentileScored 2026-11-07
Fix Fixed cobbler (PyPI): 3.0.0Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Cobbler Projectcobbler2.6.x—No fix listedCNA
—cobbler (PyPI)2.6.0 to before 3.0.03.0.0Patch availableGHSA-8787-63px-3m23
  • cobbler VendorThe Cobbler Project Affected 2.6.x Fixed in — No fix listed CNA
  • cobbler (PyPI) Vendor— Affected 2.6.0 to before 3.0.0 Fixed in 3.0.0 Patch available GHSA-8787-63px-3m23

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:cobbler_project:cobbler:*:*:*:*:*:*:*:*2.6.0 – 2.6.11VulnerableThe Cobbler Project
cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*5.6VulnerableRed Hat
cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*5.7VulnerableRed Hat
cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*5.8VulnerableRed Hat
  • cpe:2.3:a:cobbler_project:cobbler:*:*:*:*:*:*:*:* Versions 2.6.0 – 2.6.11 Vulnerable ·The Cobbler Project
  • cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:* Versions 5.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-8787-63px-3m23 cobbler (PyPI) Fixed in 3.0.0 Advisory →

Red Hat 1 advisory

  • RHSA-2018:2372 Released 2018-08-09 · Red Hat rating Critical
    cobbler security update
    • Red Hat Satellite 5.6 (RHEL v.6) cobbler-2.0.7-44.1.el6sat
    • Red Hat Satellite 5.7 (RHEL v.6) cobbler-2.0.7-68.1.el6sat
    • Red Hat Satellite 5.8 (RHEL v.6) cobbler-2.0.7-73.el6sat

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 5.6 (RHEL v.6)Fixed RHSA-2018:2372
Red Hat Satellite 5.7 (RHEL v.6)Fixed RHSA-2018:2372
Red Hat Satellite 5.8 (RHEL v.6)Fixed RHSA-2018:2372
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-10931
  2. 2026-10-03 Alias added: GHSA-8787-63px-3m23

References

Advisory 5

Other 13

  • TI-2021-17397 Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an… CVSS 3.1CRITICAL 9.8
  • TI-2021-17398 Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. CVSS 3.1HIGH 7.5
  • TI-2017-14678 Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the… CVSS 3.0CRITICAL 9.8
  • TI-2022-00766 Improper Authorization in cobbler/cobbler CVSS 3.1CRITICAL 9.1
  • TI-2021-17399 Cobbler before 3.3.0 allows authorization bypass for modification of settings. CVSS 3.1HIGH 7.5
  • TI-2021-20416 An issue was discovered in Cobbler before 3.3.1. CVSS 3.1HIGH 7.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences