Cobbler Project

11 CVEs across 1 Cobbler Project products. Browse Cobbler Project vulnerabilities, severities, and proof-of-concept exploits.

Cobbler Project products with known CVEs

ProductCVEs
Cobbler11
Cobbler Project CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2022-0860Critical9.12022-03-11Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
CVE-2021-45083High7.12022-02-20An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be ex…
CVE-2021-45081Medium5.92022-02-20An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.
CVE-2021-45082High7.82022-02-19An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules…
CVE-2021-40325High7.52021-10-04Cobbler before 3.3.0 allows authorization bypass for modification of settings.
CVE-2021-40324High7.52021-10-04Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
CVE-2021-40323Critical9.82021-10-04Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
CVE-2016-9605Medium6.12018-08-22A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file read…
CVE-2018-10931Critical9.82018-08-09It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw…
CVE-2017-1000469Critical9.82018-01-03Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.
CVE-2011-49532014-10-27The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use…