CVE-2010-2235High▾ TwilightCobbler is vulnerable to code injection
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
3.3%
3.3% → 3.4%
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
cobbler < 2.0.7Upgrade to a patched release:
cobbler 2.0.7Connected by shared product, vendor, weakness, or advisory.
CVE-2021-40323Critical· 9.8Cobbler before 3.3.0 allows log poisoning
CVE-2021-40325High· 7.5Cobbler before 3.3.0 allows authorization bypass for modification of settings.
CVE-2021-45082High· 7.8Command Injection in Cobbler
CVE-2021-45083High· 7.1Incorrect Default Permissions in Cobbler
CVE-2021-40324High· 7.5Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
CVE-2014-3225MediumCobbler Path Traversal vulnerability