cobblerd vulnerabilities

Products

• cobbler 5

Latest cobblerd CVEs

Newest publication first

1. CVE-2011-4954 cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE

   Published 2019-11-19

   High·CVSS 7.8 EPSS 0.34%

   cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE

2. CVE-2011-4952 Cobbler Web Interface Lacks CSRF Protection

   Published 2019-11-19

   High·CVSS 8.8 EPSS 0.64%

   cobbler: Web interface lacks CSRF protection when using Django framework

3. CVE-2018-1000225 Cobbler XSS Vulnerability

   Published 2018-08-20

   Medium·CVSS 6.1 EPSS 1.3%

   Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. Th...

4. CVE-2018-1000226 Cobbler Improper Validation of Security Tokens

   Published 2018-08-20

   Critical·CVSS 9.8 EPSS 12.6%

   Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation,...

5. CVE-2014-3225 Cobbler Path Traversal vulnerability

   Published 2014-05-14

   Medium·CVSS 4.0 EPSS 8.9% Public exploit

   Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.