PT-2012-4008 · Cobbler+1 · Cobbler+1

Jdstrand · Published 2012-05-29 · Updated 2024-06-15 · CVE-2012-2395

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cobbler versions 2.2.0 through 2.5.x Cobbler versions prior to 2.6.0

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the username or password fields to the power system method in the xmlrpc API.

Recommendations For Cobbler versions 2.2.0 through 2.5.x, update to version 2.6.0 or later. For Cobbler versions prior to 2.6.0, update to version 2.6.0 or later. As a temporary workaround, consider restricting access to the power system method in the xmlrpc API to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2012-2395

GHSA-G34C-MG6M-XVXJ

OPENSUSE-SU-2012_0655-1

OPENSUSE-SU-2021:0046-1

OPENSUSE-SU-2021:0058-1

OPENSUSE-SU-2021_0046-1

OPENSUSE-SU-2024:10282-1

RHSA-2012:1060

Affected Products

Cobbler

Suse

References · 99

• 🔥 https://github.com/cobbler/cobbler/commit/6d9167e5da44eca56bdf42b5776097a6779aaadf · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2021:0046-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2395 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00016.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00000.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-2395 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10282-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-2395 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0058-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-2395 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g34c-mg6m-xvxj · Vendor Advisory
• https://github.com/cobbler/cobbler/issues/141 · Note
• https://github.com/cobbler/cobbler · Note
• https://bugzilla.suse.com/1104190 · Note
• https://bugzilla.suse.com/790545 · Note