CVE-2018-1000226: Critical severity cobbler vulnerability
Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobblerapi) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000226?
CVE-2018-1000226 has been classified with a high severity due to its potential for privilege escalation and data manipulation.
How do I fix CVE-2018-1000226?
To mitigate CVE-2018-1000226, upgrade to Cobbler version 3.0.0 or later.
Which versions of Cobbler are affected by CVE-2018-1000226?
CVE-2018-1000226 affects Cobbler versions 2.0.0 up to 2.6.11.
What kind of vulnerability is CVE-2018-1000226?
CVE-2018-1000226 is an Incorrect Access Control vulnerability found in the XMLRPC API.
What risks are associated with CVE-2018-1000226?
Exploiting CVE-2018-1000226 can lead to privilege escalation and unauthorized data manipulation.