GitHub Advisoryadvisory · PyPI

GHSA-q9g5-98pm-w6q7 Cobbler XSS Vulnerability

MEDIUM Published 2022-05-14 Modified 2023-10-06 Official page ↗
Aliases
CVE-2018-1000225
Ecosystem
PyPI
Packages
cobbler
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-25

Affected packages

• PyPI cobbler: <= 2.6.11 (no fix yet)

Description

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).

Related

Alias · CVE (1)

  • CVE-2018-1000225 Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References