CVE-2022-0860 Improper Authorization in cobbler/cobbler
An attacker can bypass authorization checks in Cobbler, potentially accessing restricted functionality without proper credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0860?
CVE-2022-0860 is a high-severity missing authorization vulnerability in Fedoraproject Fedora, published on 11 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
Which versions are affected by CVE-2022-0860?
3 open source packages ship an affected version, including cobbler. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
cobbler PyPI | All versions | 3.3.2 |
cobbler PyPI | All versions | 3.3.2 |
cobbler PyPI | All versions | 3.3.2 |
Linux distribution packages (1)
cobbler openSUSE:Tumbleweed | All versions | 3.3.2.0+git.9044aa99-1.1 |
Products include Cobbler Project Cobbler, Fedoraproject Fedora.
How do I fix CVE-2022-0860?
Upgrade cobbler to 3.3.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-0860 being exploited?
There is no known exploitation of CVE-2022-0860 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2021-40323 Cobbler before 3.3.0 allows log poisoning
- CVE-2018-10931 Cobbler has Exposed Dangerous Method or Function
- CVE-2017-1000469 Cobbler vulnerable to arbitrary code execution
- CVE-2021-45082 Command Injection in Cobbler
- CVE-2021-40324 Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Sources
Also known as GHSA-mcg6-h362-cmq5, PYSEC-2022-177, UBUNTU-CVE-2022-0860, openSUSE-SU-2024:11904-1.