Lucene search

[email protected]CVE-2008-6954

HistoryAug 12, 2009 - 10:30 a.m.

CVE-2008-6954

2009-08-1210:30:00

CWE-264

[email protected]

web.nvd.nist.gov

cobbler

web interface

cobblerweb

security vulnerability

cve-2008-6954

nvd

cheetah kickstart template

python modules

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

6.9 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.0%

JSON

The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.

Affected configurations

NVD

Node

michael_dehaancobblerRange≤1.2.8

michael_dehaancobblerMatch0.1.1.7

michael_dehaancobblerMatch0.2.1

michael_dehaancobblerMatch0.2.2

michael_dehaancobblerMatch0.2.3

michael_dehaancobblerMatch0.2.5

michael_dehaancobblerMatch0.2.7

michael_dehaancobblerMatch0.2.8

michael_dehaancobblerMatch0.2.9

michael_dehaancobblerMatch0.3.0

michael_dehaancobblerMatch0.3.1

michael_dehaancobblerMatch0.3.3

michael_dehaancobblerMatch0.3.4

michael_dehaancobblerMatch0.3.5

michael_dehaancobblerMatch0.3.6

michael_dehaancobblerMatch0.3.7

michael_dehaancobblerMatch0.3.9

michael_dehaancobblerMatch0.4.0

michael_dehaancobblerMatch0.4.2

michael_dehaancobblerMatch0.4.3

michael_dehaancobblerMatch0.4.5

michael_dehaancobblerMatch0.4.6

michael_dehaancobblerMatch0.4.7

michael_dehaancobblerMatch0.4.8

michael_dehaancobblerMatch0.5.0

michael_dehaancobblerMatch0.6.0

michael_dehaancobblerMatch0.6.1

michael_dehaancobblerMatch0.6.3

michael_dehaancobblerMatch0.6.4

michael_dehaancobblerMatch0.6.5

michael_dehaancobblerMatch0.8.1

michael_dehaancobblerMatch0.8.3

michael_dehaancobblerMatch1.0.0

michael_dehaancobblerMatch1.0.2

michael_dehaancobblerMatch1.0.2-1

michael_dehaancobblerMatch1.0.3-1

michael_dehaancobblerMatch1.2.0

michael_dehaancobblerMatch1.2.2

michael_dehaancobblerMatch1.2.3

michael_dehaancobblerMatch1.2.5

michael_dehaancobblerMatch1.2.6

michael_dehaancobblerMatch1.2.7

CPENameOperatorVersion
michael_dehaan:cobblermichael dehaan cobblerle1.2.8
michael_dehaan:cobblermichael dehaan cobblereq0.1.1.7
michael_dehaan:cobblermichael dehaan cobblereq0.2.1
michael_dehaan:cobblermichael dehaan cobblereq0.2.2
michael_dehaan:cobblermichael dehaan cobblereq0.2.3
michael_dehaan:cobblermichael dehaan cobblereq0.2.5
michael_dehaan:cobblermichael dehaan cobblereq0.2.7
michael_dehaan:cobblermichael dehaan cobblereq0.2.8
michael_dehaan:cobblermichael dehaan cobblereq0.2.9
michael_dehaan:cobblermichael dehaan cobblereq0.3.0

CPE	Name	Operator	Version
michael_dehaan:cobbler	michael dehaan cobbler	le	1.2.8
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.1.1.7
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.2.1
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.2.2
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.2.3
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.2.5
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.2.7
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.2.8
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.2.9
michael_dehaan:cobbler	michael dehaan cobbler	eq	0.3.0