~ / search / GHSA-8787-63px-3m23

GHSA-8787-63px-3m23

Cobbler has Exposed Dangerous Method or Function

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-10931

Packages

EcosystemPackageAffectedFixed in
PyPI cobbler >= 2.6.0, < 3.0.0 3.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.

References

External links from the advisory. They lead to third-party sites.