p PatchFirst

CVE-2018-1000226

CVE-2018-1000226

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.

CVSS 9.8 · Critical · EPSS 12.6% · Public exploit · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • cobbler PyPI

    Versions
    • 0.6.3-2
    Affected ranges
    • ECOSYSTEM: < 3.0.0

    Update to 3.0.0

  • cobbler Ubuntu:Pro:16.04:LTS

    Versions
    • 2.4.1-0ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2.4.1-0ubuntu2+esm1

    Update to 2.4.1-0ubuntu2+esm1

Original sources

Check your server →