Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

cobbler

18 known vulnerabilities (2 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
18 · 2 critical, 1 high, 1 medium
Registry
PyPI

Advisories 18

  • CVE-2024-47533Critical 9.8

    Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes

    Affected: from 3.3.0, fixed in 3.3.7; from 3.0.0, fixed in 3.2.3.

  • Improper Authorization in cobbler/cobbler

    Affected: fixed in 3.3.2; fixed in 3.3.2.

  • An issue was discovered in Cobbler before 3.3.1.

    Affected: fixed in 3.3.1; fixed in 3.3.1.

  • An issue was discovered in Cobbler before 3.3.1.

    Affected: fixed in 3.3.1; fixed in 3.3.1.

  • Cobbler before 3.3.0 allows authorization bypass for modification of settings.

    Affected: fixed in 3.3.0.

  • Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

    Affected: fixed in 3.3.0.

  • Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template…

    Affected: fixed in 3.3.0.

  • cobbler: Web interface lacks CSRF protection when using Django framework

    Affected: fixed in 2.6.0.

  • CVE-2016-9605Medium 6.1

    A flaw was found in cobbler software component version 2.6.11-1.

    Affected: through 2.6.11-1.

  • Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older…

    Affected: fixed in 3.0.0.

  • Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older…

    Affected: through 2.6.11.

  • CVE-2018-10931Critical 9.8

    It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC.

    Affected: from 2.6.0, fixed in 3.0.0.

  • Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code…

    Affected: fixed in 3.0.0.

  • The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via…

    Affected: fixed in 2.6.0.

  • Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read…

    Affected: from 2.4.0, fixed in 2.4.7; from 2.6.0, fixed in 2.6.4; from 2.6.0, fixed in 2.6.4; from 2.4.0, fixed in 2.4.7.

Show all 18 advisoriesShow fewer advisories

  • Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell…

    Affected: fixed in 2.6.0.

  • template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of…

    Affected: fixed in 2.0.7.

  • The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by…

    Affected: fixed in 1.2.9.