CVE-2014-3225: cobblerd cobbler

Modified

AliasesGHSA-xc7w-jvhx-p6q9PYSEC-2026-797UBUNTU-CVE-2014-3225

Published 14-05-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-3225 is a medium (CVSS 4.0) vulnerability in cobblerd cobbler. EPSS estimates a 8.88% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Routine

Not severe (CVSS 4, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.0/10

010

Medium · v2.0 (NVD)

EPSS score

8.88%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2024:10282-1 USN-6475-1

Timeline

14-05-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

CVSS metrics

1 score · 1 source · 1 version

v2.04.0

EPSS trend

Probability

8.88%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 8.88% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

referenceUnverified
Exploit Reference (youtube.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
exploit-databasephpUnverified
Cobbler 2.4.x < 2.6.x - Local File Inclusion
Maturity: poc

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, authentication (CVSS vector). Other conditions: not stated in public data.

Cobblerd1 product

cobbler2.4.0 | 2.4.0:1 | 2.4.1 | 2.4.2 | 2.4.3 | 2.4.4 | 2.6.0

PyPI1 product

cobbler≥ 2.4.0, < 2.4.7 | ≥ 2.6.0, < 2.6.4

Ubuntu1 product

cobbler< 2.4.1-0ubuntu2+esm1

3 vendors · 3 products

References

18 links

seclists.org/oss-sec/2014/q2/274Mailing ListX Refsource MLISTWEB
github.com/cobbler/cobbler/issues/939X Refsource MISCWEBREPORT
www.osvdb.org/106759VDB EntryX Refsource OSVDBWEB
www.securityfocus.com/bid/67277VDB EntryX Refsource BIDWEB
seclists.org/oss-sec/2014/q2/273Mailing ListX Refsource MLISTWEB
www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.beX Refsource MISCExploitWEB
packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.htmlX Refsource MISCExploitWEB
www.securityfocus.com/archive/1/532094/100/0/threadedMailing ListX Refsource BUGTRAQWEB
www.exploit-db.com/exploits/33252ExploitX Refsource EXPLOIT DBWEB
nvd.nist.gov/vuln/detail/CVE-2014-3225Advisory

Show all 18 references