CVE-2010-2235High▾ TwilightCobbler is vulnerable to code injection
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
3.3%
3.3% → 3.4%
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
cobbler < 2.0.7Upgrade to a patched release:
cobbler 2.0.7Connected by shared product, vendor, weakness, or advisory.
CVE-2018-1000226Critical· 9.8Cobbler Improper Validation of Security Tokens
CVE-2018-10931Critical· 9.8Cobbler has Exposed Dangerous Method or Function
CVE-2017-1000469Critical· 9.8Cobbler vulnerable to arbitrary code execution
CVE-2024-47533Critical· 9.8cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
CVE-2021-40323Critical· 9.8Cobbler before 3.3.0 allows log poisoning
CVE-2021-40325High· 7.5Cobbler before 3.3.0 allows authorization bypass for modification of settings.