Vulnerabilities

TI-2011-04264 CVE-2011-4954 · GHSA-gpw3-rh6p-7pp4

cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE

LOW 34

cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00341 Published 2019-11-19 No fix listed CWE-269

TI-2011-04262 CVE-2011-4952 · GHSA-9fqr-pqc9-f7pj

cobbler: Web interface lacks CSRF protection when using Django framework

LOW 39

cobbler: Web interface lacks CSRF protection when using Django framework

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00635 Published 2019-11-19 Fixed in 2.6.0 CWE-352

TI-2018-15871 CVE-2018-1000226 · GHSA-f88q-22g8-frcg

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection…

MEDIUM 56

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.12584 Published 2018-08-20 Partial fix · 3.0.0 CWE-732

TI-2018-15870 CVE-2018-1000225 · GHSA-q9g5-98pm-w6q7

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection…

LOW 30

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbl…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01272 Published 2018-08-20 Will not fix CWE-79

TI-2014-02584 CVE-2014-3225 · GHSA-xc7w-jvhx-p6q9

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x…

LOW 30

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.08881 Published 2014-05-14 Partial fix · 2.6.4, 2.4.7 CWE-22

Vulnerabilities

Filters

cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE

cobbler: Web interface lacks CSRF protection when using Django framework

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection…

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection…

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x…