GitHub Advisoryadvisory · PyPI

GHSA-f88q-22g8-frcg Cobbler Improper Validation of Security Tokens

CRITICAL Published 2022-05-13 Modified 2026-10-27 Official page ↗
Aliases
CVE-2018-1000226
Ecosystem
PyPI
Packages
cobbler
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-732
Reviewed
2023-07-21

Affected packages

• PyPI cobbler: < 3.0.0 → fixed in 3.0.0

Description

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.

Related

Alias · CVE (1)

  • CVE-2018-1000226 Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References