# cobbler (PyPI) vulnerabilities 18 known vulnerabilities (2 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pypi.org/project/cobbler/ ## Advisories (18) ### [CVE-2024-47533](https://cve.now/CVE-2024-47533): Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes - Severity: Critical 9.8 - Published: Nov 18, 2024 - Affected: from 3.3.0, fixed in 3.3.7; from 3.0.0, fixed in 3.2.3. ### [CVE-2022-0860](https://cve.now/CVE-2022-0860): Improper Authorization in cobbler/cobbler - Severity: High 8.2 - Published: Mar 11, 2022 - Affected: fixed in 3.3.2; fixed in 3.3.2. ### [CVE-2021-45083](https://cve.now/CVE-2021-45083): An issue was discovered in Cobbler before 3.3.1. - Severity: Unrated - Published: Feb 20, 2022 - Affected: fixed in 3.3.1; fixed in 3.3.1. ### [CVE-2021-45082](https://cve.now/CVE-2021-45082): An issue was discovered in Cobbler before 3.3.1. - Severity: Unrated - Published: Feb 18, 2022 - Affected: fixed in 3.3.1; fixed in 3.3.1. ### [CVE-2021-40325](https://cve.now/CVE-2021-40325): Cobbler before 3.3.0 allows authorization bypass for modification of settings. - Severity: Unrated - Published: Oct 4, 2021 - Affected: fixed in 3.3.0. ### [CVE-2021-40324](https://cve.now/CVE-2021-40324): Cobbler before 3.3.0 allows arbitrary file write operations via upload\_log\_data. - Severity: Unrated - Published: Oct 4, 2021 - Affected: fixed in 3.3.0. ### [CVE-2021-40323](https://cve.now/CVE-2021-40323): Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template… - Severity: Unrated - Published: Oct 4, 2021 - Affected: fixed in 3.3.0. ### [CVE-2011-4952](https://cve.now/CVE-2011-4952): cobbler: Web interface lacks CSRF protection when using Django framework - Severity: Unrated - Published: Nov 19, 2019 - Affected: fixed in 2.6.0. ### [CVE-2016-9605](https://cve.now/CVE-2016-9605): A flaw was found in cobbler software component version 2.6.11-1. - Severity: Medium 6.1 - Published: Aug 22, 2018 - Affected: through 2.6.11-1. ### [CVE-2018-1000226](https://cve.now/CVE-2018-1000226): Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older… - Severity: Unrated - Published: Aug 20, 2018 - Affected: fixed in 3.0.0. ### [CVE-2018-1000225](https://cve.now/CVE-2018-1000225): Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older… - Severity: Unrated - Published: Aug 20, 2018 - Affected: through 2.6.11. ### [CVE-2018-10931](https://cve.now/CVE-2018-10931): It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. - Severity: Critical 9.8 - Published: Aug 9, 2018 - Affected: from 2.6.0, fixed in 3.0.0. ### [CVE-2017-1000469](https://cve.now/CVE-2017-1000469): Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code… - Severity: Unrated - Published: Jan 3, 2018 - Affected: fixed in 3.0.0. ### [CVE-2011-4953](https://cve.now/CVE-2011-4953): The set\_mgmt\_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via… - Severity: Unrated - Published: Oct 27, 2014 - Affected: fixed in 2.6.0. ### [CVE-2014-3225](https://cve.now/CVE-2014-3225): Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read… - Severity: Unrated - Published: May 14, 2014 - Affected: from 2.4.0, fixed in 2.4.7; from 2.6.0, fixed in 2.6.4; from 2.6.0, fixed in 2.6.4; from 2.4.0, fixed in 2.4.7. ### [CVE-2012-2395](https://cve.now/CVE-2012-2395): Incomplete blacklist vulnerability in action\_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell… - Severity: Unrated - Published: Jun 16, 2012 - Affected: fixed in 2.6.0. ### [CVE-2010-2235](https://cve.now/CVE-2010-2235): template\_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of… - Severity: Unrated - Published: Dec 9, 2010 - Affected: fixed in 2.0.7. ### [CVE-2008-6954](https://cve.now/CVE-2008-6954): The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by… - Severity: Unrated - Published: Aug 12, 2009 - Affected: fixed in 1.2.9. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/cobbler Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.