CVE-2008-6954 Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
HighCVSS 9.0
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi cobbler(PyPI) | < 1.2.9 | 1.2.9 |
| pypi cobbler(PyPI) | = 0.6.3-2 | No fix listed |
| michael dehaan cobbler | <= 1.2.8 | No fix listed |
| michael dehaan cobbler | = 0.1.1.7 | No fix listed |
| michael dehaan cobbler | = 0.2.1 | No fix listed |
| michael dehaan cobbler | = 0.2.2 | No fix listed |
| michael dehaan cobbler | = 0.2.3 | No fix listed |
| michael dehaan cobbler | = 0.2.5 | No fix listed |
| michael dehaan cobbler | = 0.2.7 | No fix listed |
| michael dehaan cobbler | = 0.2.8 | No fix listed |
| michael dehaan cobbler | = 0.2.9 | No fix listed |
| michael dehaan cobbler | = 0.3.0 | No fix listed |
| michael dehaan cobbler | = 0.3.1 | No fix listed |
| michael dehaan cobbler | = 0.3.3 | No fix listed |
| michael dehaan cobbler | = 0.3.4 | No fix listed |
| michael dehaan cobbler | = 0.3.5 | No fix listed |
| michael dehaan cobbler | = 0.3.6 | No fix listed |
| michael dehaan cobbler | = 0.3.7 | No fix listed |
| michael dehaan cobbler | = 0.3.9 | No fix listed |
| michael dehaan cobbler | = 0.4.0 | No fix listed |
| michael dehaan cobbler | = 0.4.2 | No fix listed |
| michael dehaan cobbler | = 0.4.3 | No fix listed |
| michael dehaan cobbler | = 0.4.5 | No fix listed |
| michael dehaan cobbler | = 0.4.6 | No fix listed |
| michael dehaan cobbler | = 0.4.7 | No fix listed |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| michael dehaan cobbler | = 0.4.8 | No fix listed |
| michael dehaan cobbler | = 0.5.0 | No fix listed |
| michael dehaan cobbler | = 0.6.0 | No fix listed |
| michael dehaan cobbler | = 0.6.1 | No fix listed |
| michael dehaan cobbler | = 0.6.3 | No fix listed |
| michael dehaan cobbler | = 0.6.4 | No fix listed |
| michael dehaan cobbler | = 0.6.5 | No fix listed |
| michael dehaan cobbler | = 0.8.1 | No fix listed |
| michael dehaan cobbler | = 0.8.3 | No fix listed |
| michael dehaan cobbler | = 1.0.0 | No fix listed |
| michael dehaan cobbler | = 1.0.2 | No fix listed |
| michael dehaan cobbler | = 1.0.2-1 | No fix listed |
| michael dehaan cobbler | = 1.0.3-1 | No fix listed |
| michael dehaan cobbler | = 1.2.0 | No fix listed |
| michael dehaan cobbler | = 1.2.2 | No fix listed |
| michael dehaan cobbler | = 1.2.3 | No fix listed |
| michael dehaan cobbler | = 1.2.5 | No fix listed |
| michael dehaan cobbler | = 1.2.6 | No fix listed |
| michael dehaan cobbler | = 1.2.7 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- cobbler-interface-code-execution(46625) vdb-entry
- github.com product
- web.archive.org
- web.archive.org
- web.archive.org
- FEDORA-2008-9723 vendor-advisory
- FEDORA-2008-9745 vendor-advisory
- freshmeat.net patch
- pypi.org product
- github.com vendor-advisory
- 50291 vdb-entry
- 32737 third-party-advisory vendor-advisory
- 32804 third-party-advisory vendor-advisory
- 32317 patch vdb-entry