PT-2014-5150 · Cobbler+1 · Cobbler+1

Publicado 2014-05-14 · Atualizado 2024-06-15 · CVE-2014-3225

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cobbler versions 2.4.x through 2.6.x

Description The issue allows remote authenticated users to read arbitrary files via the Kickstart field in a profile due to an absolute path traversal vulnerability in the web interface.

Recommendations For Cobbler versions 2.4.x through 2.6.x, consider restricting access to the Kickstart field in profiles to minimize the risk of exploitation until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-3225

GHSA-XC7W-JVHX-P6Q9

OPENSUSE-SU-2024:10282-1

USN-6475-1

Produtos afetados

Cobbler

Ubuntu

Referências · 33

• 🔥 http://packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.html · Exploit
• 🔥 https://youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.be · Exploit
• 🔥 http://exploit-db.com/exploits/33252 · Exploit
• 🔥 https://exploit-db.com/exploits/33252 · Exploit
• https://github.com/cobbler/cobbler/issues/939 · Nota
• https://github.com/cobbler/cobbler · Nota
• https://github.com/cobbler/cobbler/commit/8232c0e88ec7382d3f8d3bf48c81a4a91ac4325d · Nota
• https://github.com/cobbler/cobbler/commit/f757e3096fcd32397609ca38efb01f19d16dd634 · Nota
• https://suse.com/security/cve/CVE-2014-3225 · Nota
• https://ubuntu.com/security/CVE-2021-40324 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2021-45083 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6475-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3225 · Aviso do Fabricante
• http://osvdb.org/106759 · Nota
• https://ubuntu.com/security/CVE-2018-10931 · Aviso do Fabricante