What is the severity of CVE-2012-2395?

CVE-2012-2395 is classified as a high severity vulnerability due to its potential for remote command execution.

How do I fix CVE-2012-2395?

To fix CVE-2012-2395, upgrade Cobbler to version 2.2.1 or later, where the vulnerability is patched.

What type of vulnerability is CVE-2012-2395?

CVE-2012-2395 is an incomplete blacklist vulnerability that allows remote attackers to execute arbitrary commands.

What affected software does CVE-2012-2395 impact?

CVE-2012-2395 specifically impacts Cobbler version 2.2.0.

How can CVE-2012-2395 be exploited?

CVE-2012-2395 can be exploited by attackers who manipulate the username or password fields in the power_system method of the XML-RPC API.

Vulnerability/
CVE-2012-2395

high

7.5

16/6/2012

6/8/2024

CVE-2012-2395

First published: Sat Jun 16 2012(Updated: )

Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
Michael Dehaan Cobbler	=2.2.0

Remedy

https://github.com/cobbler/cobbler/commit/6d9167e5da44eca56bdf42b5776097a6779aaadf

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2012-2395?
CVE-2012-2395 is classified as a high severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2012-2395?
To fix CVE-2012-2395, upgrade Cobbler to version 2.2.1 or later, where the vulnerability is patched.
What type of vulnerability is CVE-2012-2395?
CVE-2012-2395 is an incomplete blacklist vulnerability that allows remote attackers to execute arbitrary commands.
What affected software does CVE-2012-2395 impact?
CVE-2012-2395 specifically impacts Cobbler version 2.2.0.
How can CVE-2012-2395 be exploited?
CVE-2012-2395 can be exploited by attackers who manipulate the username or password fields in the power_system method of the XML-RPC API.

agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/author
agent/severity
agent/references
agent/remedy
agent/description
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/michael dehaan
canonical/michael dehaan cobbler
version/michael dehaan cobbler/2.2.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2012-2395?
CVE-2012-2395 is classified as a high severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2012-2395?
To fix CVE-2012-2395, upgrade Cobbler to version 2.2.1 or later, where the vulnerability is patched.
What type of vulnerability is CVE-2012-2395?
CVE-2012-2395 is an incomplete blacklist vulnerability that allows remote attackers to execute arbitrary commands.
What affected software does CVE-2012-2395 impact?
CVE-2012-2395 specifically impacts Cobbler version 2.2.0.
How can CVE-2012-2395 be exploited?
CVE-2012-2395 can be exploited by attackers who manipulate the username or password fields in the power_system method of the XML-RPC API.