Description
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
References (4)
Scores
CVSS v3
9.8
EPSS
0.3605
EPSS Percentile
97.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-749
Status
published
Products (5)
cobbler_project/cobbler
2.6.0 - 2.6.11
pypi/cobbler
2.6.0 - 3.0.0PyPI
redhat/satellite
5.6
redhat/satellite
5.7
redhat/satellite
5.8
Published
Aug 09, 2018
Tracked Since
Feb 18, 2026