CVE-2014-3225: Path Traversal
Published May 14, 2014
·Updated
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
Affected Software
9 affected componentsFixes available
pip/cobbler>=2.4.0<2.4.7
2.4.7
pip/cobbler>=2.6.0<2.6.4
2.6.4
Cobblerd Cobbler=2.4.0
Cobblerd Cobbler=2.4.0-1
Cobblerd Cobbler=2.4.1
Cobblerd Cobbler=2.4.2
Cobblerd Cobbler=2.4.3
Cobblerd Cobbler=2.4.4
Cobblerd Cobbler=2.6.0
Event History
May 14, 2014
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·12:55 AM
DescriptionSeverityWeaknessAffected Software
May 14, 2022
Advisory Published
via GitHub·02:52 AM
Frequently Asked Questions
1
What is the severity of CVE-2014-3225?
CVE-2014-3225 is rated as a medium severity vulnerability due to its potential for unauthorized file access by authenticated users.
2
How do I fix CVE-2014-3225?
To fix CVE-2014-3225, upgrade Cobbler to version 2.4.7 or 2.6.4, which contain the necessary patches.
3
Who is affected by CVE-2014-3225?
CVE-2014-3225 affects Cobbler versions from 2.4.0 to 2.6.x, specifically those prior to the patched releases.
4
What type of vulnerability is CVE-2014-3225?
CVE-2014-3225 is classified as an absolute path traversal vulnerability in the web interface.
5
Can unprivileged users exploit CVE-2014-3225?
No, CVE-2014-3225 requires authenticated users to exploit the vulnerability to access arbitrary files.