Cobbler before 3.3.0 allows log poisoning · CVE-2021-40323 · GitHub Advisory Database · GitHub

Cobbler before 3.3.0 allows log poisoning

High severity GitHub Reviewed Published Oct 5, 2021 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

cobbler (pip)

Affected versions

< 3.3.0

Patched versions

3.3.0

Description

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

References

Published by the National Vulnerability Database

Oct 4, 2021

Reviewed Oct 5, 2021

Published to the GitHub Advisory Database Oct 5, 2021

Last updated Feb 1, 2023