CVE-2017-1000469 — Improper Input Validation in Project Cobbler

CWE-20 — Improper Input ValidationCWE-77 — Command Injection11 documents7 sources
Severity
9.8CRITICALNVD
OSV4.0
EPSS
0.9%
top 23.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cobbler Project Cobbler
Timeline
PublishedJan 3
Latest updateNov 13

Description

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Ubuntucobbler_project/cobbler< 2.4.1-0ubuntu2+esm1

🔴Vulnerability Details

5
OSV
cobbler vulnerabilities↗2023-11-13
▶
GHSA
Cobbler vulnerable to arbitrary code execution↗2022-05-14
▶
OSV
Cobbler vulnerable to arbitrary code execution↗2022-05-14
▶
OSV
CVE-2017-1000469: Cobbler version up to 2↗2018-01-03
▶
CVEList
CVE-2017-1000469: Cobbler version up to 2↗2018-01-03
▶

📋Vendor Advisories

2
Ubuntu
Cobbler vulnerabilities↗2023-11-13
▶
Red Hat
cobbler: Command injection in the "add repo" component allows for remote code execution↗2017-10-19
▶

💬Community

3
Bugzilla
CVE-2017-1000469 cobbler: Command injection in the "add repo" component allows for remote code execution [fedora-all]↗2018-01-09
▶
Bugzilla
CVE-2017-1000469 cobbler: Command injection in the "add repo" component allows for remote code execution↗2018-01-09
▶
Bugzilla
CVE-2017-1000469 cobbler: Command injection in the "add repo" component allows for remote code execution [epel-all]↗2018-01-09
▶
CVE-2017-1000469 — Improper Input Validation | cvebase