Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / cobbler/PYSEC-2026-797
Advisory ID pypa/cobbler/PYSEC-2026-797
Aliases CVE-2014-3225
GHSA-xc7w-jvhx-p6q9
PYSEC-2026-797
Summary Cobbler Path Traversal vulnerability Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
http://packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.html
http://seclists.org/oss-sec/2014/q2/273
http://seclists.org/oss-sec/2014/q2/274
https://github.com/advisories/GHSA-xc7w-jvhx-p6q9
https://github.com/cobbler/cobbler
https://github.com/cobbler/cobbler/commit/8232c0e88ec7382d3f8d3bf48c81a4a91ac4325d
https://github.com/cobbler/cobbler/commit/f757e3096fcd32397609ca38efb01f19d16dd634
https://github.com/cobbler/cobbler/issues/939
https://pypi.org/project/cobbler
https://www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.be
http://www.exploit-db.com/exploits/33252
http://www.osvdb.org/106759
http://www.securityfocus.com/archive/1/532094/100/0/threaded
http://www.securityfocus.com/bid/67277
CVE-2014-3225 https://nvd.nist.gov/vuln/detail/CVE-2014-3225
Data source Exploit-DB
Date added May 8, 2014
Description Cobbler 2.4.x < 2.6.x - Local File Inclusion
Ransomware campaign use Unknown
Source publication date May 8, 2014
Exploit type webapps
Platform php
Source update date May 8, 2014

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.