CVE-2018-10931 Cobbler has Exposed Dangerous Method or Function
Unauthenticated attackers can access all XMLRPC functions to gain high privileges and upload files to arbitrary locations on the Cobbler server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10931?
CVE-2018-10931 is a critical missing authorization vulnerability in Redhat Satellite, published on 9 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
Weakness: CWE-749
Which versions are affected by CVE-2018-10931?
3 open source packages ship an affected version, including cobbler. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
cobbler PyPI | From 2.6.0 | 3.0.0 |
cobbler PyPI | From 2.6.0 | 3.0.0 |
cobbler PyPI | From 2.6.0 | 3.0.0 |
Linux distribution packages (5)
cobbler Red Hat:network_satellite:5.6::el6 | All versions | 0:2.0.7-44.1.el6sat |
cobbler Red Hat:network_satellite:5.7::el6 | All versions | 0:2.0.7-68.1.el6sat |
cobbler Red Hat:network_satellite:5.8::el6 | All versions | 0:2.0.7-73.el6sat |
cobbler SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS | All versions | 2.2.2-0.68.6.1 |
cobbler SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS | All versions | 2.2.2-0.68.6.1 |
Products include Cobbler Project Cobbler, Redhat Satellite.
How do I fix CVE-2018-10931?
Upgrade cobbler to 3.0.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-10931 being exploited?
There is no known exploitation of CVE-2018-10931 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2021-40323 Cobbler before 3.3.0 allows log poisoning
- CVE-2017-1000469 Cobbler vulnerable to arbitrary code execution
- CVE-2022-0860 Improper Authorization in cobbler/cobbler
- CVE-2021-45082 Command Injection in Cobbler
- CVE-2021-40324 Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Sources
Also known as GHSA-8787-63px-3m23, PYSEC-2026-313, RHSA-2018:2372, SUSE-SU-2018:2550-1, UBUNTU-CVE-2018-10931.