WID-SEC-W-2023-2927

DeutschShown in its original language — a full translation is planned for a future version.

cobbler: Mehrere Schwachstellen

view advisory published 2021-09-22

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cobbler ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, vertrauliche Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.

describes (3)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-40325US	high7.5OT elevated	1.41% (72nd)	—	2021-10-04
Cobbler before 3.3.0 allows authorization bypass for modification of settings.
CVE-2021-40324US	high7.5	68.6% (99th)	—	2021-10-04
Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
CVE-2021-40323US	critical9.8	86.8% (100th)	—	2021-10-04
Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

references

External citations — patches, advisories, analysis.

Bugzilla Security Advisory vom 2021-09-22external
Bugzilla Security Advisory vom 2021-09-22external
Bugzilla Security Advisory vom 2021-09-22external
POC Codeexternal
Ubuntu Security Notice USN-6475-1 vom 2023-11-15external
WID-SEC-W-2023-2927 - CSAF Versionself
WID-SEC-2023-2927 - Portal Versionself

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan