CVEブラウザに戻る

CVE-2018-10931

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0960%

EPSS Percentile23.02th

Published2018年8月9日

Last Modified2024年11月21日

Vulnerability Description

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.

Affected Platforms (CPE)

📦

Cobbler Project

Cobbler

>= 2.6.0 and <= 2.6.11

📦

Redhat

Satellite

= 5.6

📦

Redhat

Satellite

= 5.7

📦

Redhat

Satellite

= 5.8

References & Advisories

🔗 https://access.redhat.com/errata/RHSA-2018:2372

🔗 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10931

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5Q4ACIVZ5D4KSUDLGRTOKGGB4U42SD/

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMWK5KCCZXOGOYNR2H6BWDSABTQ5NYJA/

🔗 https://access.redhat.com/errata/RHSA-2018:2372

🔗 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10931

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5Q4ACIVZ5D4KSUDLGRTOKGGB4U42SD/

🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMWK5KCCZXOGOYNR2H6BWDSABTQ5NYJA/

関連する脆弱性情報

CVE-2017-10004699.8

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary ...

CVE-2018-10002269.8

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even old...

CVE-2021-403239.8

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for ...

CVE-2008-69549.0

The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobbl...