Cobbler

This hub aggregates every CVE we track for Cobbler, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Cobbler.

• CVE-2024-47533Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes9.8Nov 18, 2024
• CVE-2022-0860Improper Authorization in cobbler/cobbler9.1Mar 11, 2022
• CVE-2021-45083An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-priv...7.1Feb 20, 2022
• CVE-2021-45081An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.5.9Feb 20, 2022
• CVE-2021-45082An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substri...7.8Feb 18, 2022
• CVE-2021-40325Cobbler before 3.3.0 allows authorization bypass for modification of settings.7.5Oct 4, 2021
• CVE-2021-40324Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.7.5Oct 4, 2021
• CVE-2021-40323Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.9.8Oct 4, 2021
• CVE-2012-2092A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.5.9Dec 6, 2019
• CVE-2011-4954cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE7.8Nov 19, 2019
• CVE-2011-4952cobbler: Web interface lacks CSRF protection when using Django framework8.8Nov 19, 2019
• CVE-2016-9605A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigati...6.1Aug 22, 2018
• CVE-2018-1000226Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control v...9.8Aug 20, 2018
• CVE-2018-1000225Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS)...6.1Aug 20, 2018
• CVE-2018-10931It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobble...9.8Aug 9, 2018