PT-2022-13479 · Cobbler+2 · Cobbler+2

Published 2022-03-11 · Updated 2024-06-15 · CVE-2022-0860

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions cobbler/cobbler versions prior to 3.3.2

Description The issue concerns improper authorization in the GitHub repository cobbler/cobbler. If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places, including the Web UI, CLI, and XMLRPC-API. This also applies to user accounts with passwords set to be expired.

Recommendations For versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue. As a temporary workaround, consider deleting expired accounts that are able to access Cobbler via PAM. Use chage -l <username> to lock the account. If the account has SSH-Keys attached, then remove them completely.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2022-0860

GHSA-MCG6-H362-CMQ5

OPENSUSE-SU-2023_1831-1

OPENSUSE-SU-2024:11904-1

PYSEC-2022-177

SUSE-SU-2022:3750-1

SUSE-SU-2022:3761-1

SUSE-SU-2023:0592-1

USN-6475-1

Affected Products

Suse

Ubuntu

Cobbler

References · 148

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0860.json · Exploit
• 🔥 https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d · Exploit
• https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa · Patch
• https://ubuntu.com/security/CVE-2021-45083 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40325 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40323 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mcg6-h362-cmq5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3750-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0860 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0592-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0860 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM · Vendor Advisory