Cobbler vulnerabilities
4 vulnerabilities
Known vulnerabilities in Cobbler products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Cobbler3 vulnerabilities
- Cobbler/Cobbler1 vulnerabilities
PrioritiseCVE-2024-47533cobbler +7 moreCobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changesCobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.CVSS9.8CriticalEPSS4.00%PrioritiseCVE-2022-0860cobbler · cobbler/cobbler +5 moreImproper Authorization in cobbler/cobblerImproper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.CVSS9.1CriticalEPSS2.26%RoutineCVE-2011-4954cobbler +1 morecobbler cobblercobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHECVSS7.8HighEPSS0.34%RoutineCVE-2011-4952cobbler +2 morecobbler cobblercobbler: Web interface lacks CSRF protection when using Django frameworkCVSS8.8HighEPSS0.64%