GCVE - cpe:2.3:a:cobbler:cobbler:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cobbler:cobbler:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cobbler (`d58e10c7-3101-58a9-a2c2-185b7494eb1b`)
Product	Cobbler (`cefc4802-0882-52ee-8b22-de70eb82e936`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-47533`	vulnerable	2026-06-08 06:48:12.535683	Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes CRITICAL (9.8) Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue. Published: 2024-11-18T16:33:55.229Z Updated: 2024-11-18T18:24:07.378Z Open on db.gcve.eu Reference links https://github.com/cobbler/cobbler/security/advisories/GHSA-m26c-fcgh-cp6h https://github.com/cobbler/cobbler/commit/32c5cada013dc8daa7320a8eda9932c2814742b0 https://github.com/cobbler/cobbler/commit/e19717623c10b29e7466ed4ab23515a94beb2dda	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4954`	vulnerable	2026-06-08 04:59:34.017253	Details available cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE Published: 2019-11-19T15:41:37.000Z Updated: 2024-08-07T00:23:38.937Z Open on db.gcve.eu Reference links https://security-tracker.debian.org/tracker/CVE-2011-4954 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4954 https://access.redhat.com/security/cve/cve-2011-4954 http://www.openwall.com/lists/oss-security/2012/04/12/10 https://bugs.gentoo.org/show_bug.cgi?id=CVE-2011-4954	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4952`	vulnerable	2026-06-08 04:59:34.014787	Details available cobbler: Web interface lacks CSRF protection when using Django framework Published: 2019-11-19T15:29:47.000Z Updated: 2024-08-07T00:23:39.818Z Open on db.gcve.eu Reference links https://security-tracker.debian.org/tracker/CVE-2011-4952 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4952 https://access.redhat.com/security/cve/cve-2011-4952 http://www.openwall.com/lists/oss-security/2012/04/12/10	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.