GitHub Advisoryadvisory · PyPI

GHSA-xc7w-jvhx-p6q9 Cobbler Path Traversal vulnerability

MEDIUM Published 2022-05-14 Modified 2024-04-08 Official page ↗
Aliases
CVE-2014-3225
Ecosystem
PyPI
Packages
cobbler
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2024-04-08

Affected packages

• PyPI cobbler: >= 2.6.0, < 2.6.4 → fixed in 2.6.4 • PyPI cobbler: >= 2.4.0, < 2.4.7 → fixed in 2.4.7

Description

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

Related

Alias · CVE (1)

  • CVE-2014-3225 Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References