CVE-2021-40323

Aliases:GHSA-cpqf-3c3r-c9g2PYSEC-2021-373
Advisory lineage Upstream: 0 Downstream: 5
Modified
Published: 04 Oct 2021, 05:37
Last modified:04 Aug 2024, 02:27

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (nvd)
EPSS Score
93.17% CRITICAL
93% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Oct 2021, 05:37
Published
Vulnerability first disclosed
04 Aug 2024, 02:27
Last Modified
Vulnerability information updated

Description

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

CVSS Metrics

  • v4.0•CRITICAL•Score: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 93.17%• Percentile: 100%

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

  • cobbler_project•cobbler

    ≤ 3.3.0

  • PyPI•cobbler

    < d8f60bbf14a838c8c8a1dba98086b223e35fe70a | < 3.3.0

References (6)