CVE-2024-47533
CVE-2024-47533 · Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
CVSS 9.8 · Critical · EPSS 4.0% · Public exploit · Fix available
- Published
- Updated
Stack: python
Affected products and versions
cobbler
- Versions
- >= 3.0.0, < 3.2.3: Affected
- >= 3.3.0, < 3.3.7: Affected
No fix published
cobbler PyPI
- Versions
- 3.3.0
- 3.3.1
- 3.3.2
- 3.3.3
- 3.3.4
- 3.3.5
- 3.3.6
- Affected ranges
- ECOSYSTEM: ≥ 3.3.0, < 3.3.7
Update to 3.3.7
cobbler PyPI
- Versions
- 3.1.2
- 3.2.1
- 3.2.2
- Affected ranges
- ECOSYSTEM: ≥ 3.0.0, < 3.2.3
Update to 3.2.3
cobbler PyPI
- Versions
- 3.1.2
- 3.2.1
- 3.2.2
- 3.3.0
- 3.3.1
- 3.3.2
- 3.3.3
- 3.3.4
- 3.3.5
- 3.3.6
- Affected ranges
- ECOSYSTEM: ≥ 3.0.0, < 3.2.3 ∪ ≥ 3.3.0, < 3.3.7
Update to 3.2.3; Update to 3.3.7