CVE-2010-2235 - CVE House
Back to Database
Status published High CVE-2010-2235

template_api.py in Cobbler before 2.0.7, as used in Red Hat...

Vulnerability Description

template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-2235

Credits & Attribution

No credits recorded in the NVD database.

References

More from michael dehaan

View All →
CVE-2012-2395
Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote...
High 7.5
CVE-2010-4512
Cobbler before 2.0.4 uses an incorrect umask value, which allows...
High 7.2
CVE-2009-5021
Cobbler before 1.6.1 does not properly determine whether an installation...
High 7.5
CVE-2008-6954
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote...
Critical 9

Affected Vendor

michael dehaan

View all reports →

Affected Software

cobbler
Vulnerable Versions:
0, 0.1.1.7, 0.2.1, 0.2.2, 0.2.3, 0.2.5, 0.2.7, 0.2.8, 0.2.9, 0.3.0, 0.3.1, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.9, 0.4.0, 0.4.2, 0.4.3, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.5.0, 0.6.0, 0.6.1, 0.6.3, 0.6.4, 0.6.5, 0.8.1, 0.8.3, 1.0.0, 1.0.2, 1.0.2-1, 1.0.3-1, 1.2.0, 1.2.2, 1.2.3, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.8-1, 1.2.9, 1.2.9-1, 1.3.1, 1.3.1-1, 1.3.3, 1.3.3-1, 1.3.4, 1.3.4-1, 1.4.0, 1.4.0-2, 1.4.1, 1.4.1-1, 1.4.2, 1.4.2-1, 1.4.3, 1.4.3-4, 1.6.1, 1.6.1-1, 1.6.2, 1.6.2-1, 1.6.3, 1.6.3-1, 1.6.4, 1.6.4-1, 1.6.5, 1.6.5-1, 1.6.6, 1.6.6-1, 1.6.8, 1.6.8-1, 2.0.0, 2.0.0-1, 2.0.1, 2.0.1-1, 2.0.3, 2.0.3.1, 2.0.3.1-2, 2.0.4-1

Timeline

Official Publish: December 9th, 2010
Last Modified: August 7th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.