Cobbler before 2.0.4 uses an incorrect umask value, which allows local users to have an unspecified impact by leveraging world writable permissions for files and directories.

Cobbler CobblerXMLRPCInterface object exposes all its functions over XMLRPC. This allows an attacker to use internal the internal functions of the class, such as creating a token, or upload files.

Upstream issue:

https://github.com/cobbler/cobbler/issues/1916

Upstream patch:

https://github.com/cobbler/cobbler/pull/1921

References:

https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/