7.1

CVE-2021-45083: cobbler_project cobbler Incorrect Default Permissions

CVSS: 7.1v3.1HighModified
AliasesSUSE-SU-2022:0507-1SUSE-SU-2022:14891-1GHSA-5946-mpw5-pqxx
Published 20-02-2022Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-45083 is a high (CVSS 7.1) Incorrect Default Permissions vulnerability in cobbler_project cobbler. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.5% of scored vulnerabilities.

Overall risk
28/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.1/10
010
High · v3.1 (NVD)
EPSS score
0.31%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
SUSE-SU-2022:0509-1SUSE-SU-2022:0510-1USN-6475-1

Timeline

  1. 20-02-2022
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.

CVSS metrics

5 scores · 3 sources · 3 versions

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

0.00 pp

From 0.31% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse6 products
  • cobbler&distro=HPE Helion OpenStack 8< 2.6.6-49.35.1
  • cobbler&distro=SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS< 2.2.2-0.68.15.1
  • cobbler&distro=SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS< 2.2.2-0.68.15.1
  • cobbler&distro=SUSE Manager Client Tools 12< 2.6.6-49.35.1
  • cobbler&distro=SUSE OpenStack Cloud 8< 2.6.6-49.35.1
Cobbler_project1 product
Fedoraproject1 product
PyPI1 product
  • cobbler< 3.3.1
Ubuntu1 product
  • cobbler< 2.4.1-0ubuntu2+esm1

5 vendors · 10 products

References

24 links
Show all 24 references