Lucene search

MitreCVE-2008-6954

HistoryAug 12, 2009 - 10:30 a.m.

CVE-2008-6954

2009-08-1210:30:00

CWE-264

mitre

web.nvd.nist.gov

cobbler

web interface

cobblerweb

security vulnerability

cve-2008-6954

nvd

cheetah kickstart template

python modules

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

AI Score

6.9

Confidence

Low

EPSS

0.004

Percentile

72.9%

JSON

The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.

Affected configurations

Nvd

Node

michael_dehaancobblerRange≤1.2.8

michael_dehaancobblerMatch0.1.1.7

michael_dehaancobblerMatch0.2.1

michael_dehaancobblerMatch0.2.2

michael_dehaancobblerMatch0.2.3

michael_dehaancobblerMatch0.2.5

michael_dehaancobblerMatch0.2.7

michael_dehaancobblerMatch0.2.8

michael_dehaancobblerMatch0.2.9

michael_dehaancobblerMatch0.3.0

michael_dehaancobblerMatch0.3.1

michael_dehaancobblerMatch0.3.3

michael_dehaancobblerMatch0.3.4

michael_dehaancobblerMatch0.3.5

michael_dehaancobblerMatch0.3.6

michael_dehaancobblerMatch0.3.7

michael_dehaancobblerMatch0.3.9

michael_dehaancobblerMatch0.4.0

michael_dehaancobblerMatch0.4.2

michael_dehaancobblerMatch0.4.3

michael_dehaancobblerMatch0.4.5

michael_dehaancobblerMatch0.4.6

michael_dehaancobblerMatch0.4.7

michael_dehaancobblerMatch0.4.8

michael_dehaancobblerMatch0.5.0

michael_dehaancobblerMatch0.6.0

michael_dehaancobblerMatch0.6.1

michael_dehaancobblerMatch0.6.3

michael_dehaancobblerMatch0.6.4

michael_dehaancobblerMatch0.6.5

michael_dehaancobblerMatch0.8.1

michael_dehaancobblerMatch0.8.3

michael_dehaancobblerMatch1.0.0

michael_dehaancobblerMatch1.0.2

michael_dehaancobblerMatch1.0.2-1

michael_dehaancobblerMatch1.0.3-1

michael_dehaancobblerMatch1.2.0

michael_dehaancobblerMatch1.2.2

michael_dehaancobblerMatch1.2.3

michael_dehaancobblerMatch1.2.5

michael_dehaancobblerMatch1.2.6

michael_dehaancobblerMatch1.2.7

VendorProductVersionCPE
michael_dehaancobbler*cpe:2.3:a:michael_dehaan:cobbler:*:*:*:*:*:*:*:*
michael_dehaancobbler0.1.1.7cpe:2.3:a:michael_dehaan:cobbler:0.1.1.7:*:*:*:*:*:*:*
michael_dehaancobbler0.2.1cpe:2.3:a:michael_dehaan:cobbler:0.2.1:*:*:*:*:*:*:*
michael_dehaancobbler0.2.2cpe:2.3:a:michael_dehaan:cobbler:0.2.2:*:*:*:*:*:*:*
michael_dehaancobbler0.2.3cpe:2.3:a:michael_dehaan:cobbler:0.2.3:*:*:*:*:*:*:*
michael_dehaancobbler0.2.5cpe:2.3:a:michael_dehaan:cobbler:0.2.5:*:*:*:*:*:*:*
michael_dehaancobbler0.2.7cpe:2.3:a:michael_dehaan:cobbler:0.2.7:*:*:*:*:*:*:*
michael_dehaancobbler0.2.8cpe:2.3:a:michael_dehaan:cobbler:0.2.8:*:*:*:*:*:*:*
michael_dehaancobbler0.2.9cpe:2.3:a:michael_dehaan:cobbler:0.2.9:*:*:*:*:*:*:*
michael_dehaancobbler0.3.0cpe:2.3:a:michael_dehaan:cobbler:0.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
michael_dehaan	cobbler	*	cpe:2.3:a:michael_dehaan:cobbler::::::::
michael_dehaan	cobbler	0.1.1.7	cpe:2.3:a:michael_dehaan:cobbler:0.1.1.7:::::::*
michael_dehaan	cobbler	0.2.1	cpe:2.3:a:michael_dehaan:cobbler:0.2.1:::::::*
michael_dehaan	cobbler	0.2.2	cpe:2.3:a:michael_dehaan:cobbler:0.2.2:::::::*
michael_dehaan	cobbler	0.2.3	cpe:2.3:a:michael_dehaan:cobbler:0.2.3:::::::*
michael_dehaan	cobbler	0.2.5	cpe:2.3:a:michael_dehaan:cobbler:0.2.5:::::::*
michael_dehaan	cobbler	0.2.7	cpe:2.3:a:michael_dehaan:cobbler:0.2.7:::::::*
michael_dehaan	cobbler	0.2.8	cpe:2.3:a:michael_dehaan:cobbler:0.2.8:::::::*
michael_dehaan	cobbler	0.2.9	cpe:2.3:a:michael_dehaan:cobbler:0.2.9:::::::*
michael_dehaan	cobbler	0.3.0	cpe:2.3:a:michael_dehaan:cobbler:0.3.0:::::::*