CVE-2008-6954

Cobbler < 1.2.9 - Authenticated Remote Code Execution via Cheetah Kickstart Template

Title source: llm

Description

The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.

References (8)

Core 8

Core References

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/50291

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/32804

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/32737

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/46625

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/32317

Patch x_refsource_confirm

http://freshmeat.net/projects/cobbler/releases/288374

Scores

EPSS 0.0215

EPSS Percentile 80.2%

Details

CWE

CWE-264

Status published

Products (43)

michael_dehaan/cobbler 0.1.1.7

michael_dehaan/cobbler 0.2.1

michael_dehaan/cobbler 0.2.2

michael_dehaan/cobbler 0.2.3

michael_dehaan/cobbler 0.2.5

michael_dehaan/cobbler 0.2.7

michael_dehaan/cobbler 0.2.8

michael_dehaan/cobbler 0.2.9

michael_dehaan/cobbler 0.3.0

michael_dehaan/cobbler 0.3.1

... and 33 more

Published Aug 12, 2009

Tracked Since Feb 18, 2026