PT-2012-4008 · Cobbler+1 · Cobbler+1

Jdstrand

·

Publicado

2012-05-29

·

Atualizado

2024-06-15

·

CVE-2012-2395

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Cobbler versions 2.2.0 through 2.5.x Cobbler versions prior to 2.6.0
Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the username or password fields to the power system method in the xmlrpc API.
Recommendations For Cobbler versions 2.2.0 through 2.5.x, update to version 2.6.0 or later. For Cobbler versions prior to 2.6.0, update to version 2.6.0 or later. As a temporary workaround, consider restricting access to the power system method in the xmlrpc API to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2012-2395
GHSA-G34C-MG6M-XVXJ
OPENSUSE-SU-2012_0655-1
OPENSUSE-SU-2021:0046-1
OPENSUSE-SU-2021:0058-1
OPENSUSE-SU-2021_0046-1
OPENSUSE-SU-2024:10282-1
RHSA-2012:1060

Produtos afetados

Cobbler
Suse