CVE-2018-1000226 - CVE House
Back to Database
Status published Critical CVE-2018-1000226

Cobbler version Verified as present in Cobbler versions 2.6.11+, but...

Vulnerability Description

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-1000226

Credits & Attribution

No credits recorded in the NVD database.

References

More from cobblerd

View All →
CVE-2018-1000225
Cobbler version Verified as present in Cobbler versions 2.6.11+, but...
Medium 6.1
CVE-2014-3225
Absolute path traversal vulnerability in the web interface in Cobbler...
Medium 4

Affected Vendor

Affected Software

cobbler
Vulnerable Versions:
2.0.0

Timeline

Official Publish: August 20th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.