Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2008-6954US | high9.0 | — | ||
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to imp… | ||||
02
references
External citations — patches, advisories, analysis.
- http://freshmeat.net/projects/cobbler/releases/288374WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46625WEB
- https://github.com/cobbler/cobblerPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2008-6954ADVISORY
- https://web.archive.org/web/20111227125913/http://secunia.com/advisories/32804WEB
- https://web.archive.org/web/20111227151912/http://secunia.com/advisories/32737WEB
- https://web.archive.org/web/20200228143518/http://www.securityfocus.com/bid/32317WEB
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan