VulnerabilityModified
CVE-2014-3225
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
MEDIUM 4.0EPSS 8.88%
Does this matter?
Lower severity and a low EPSS score (8.88%). Track it; it rarely justifies an emergency change on its own.
Description
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
- EPSS
- 8.88% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- cobblerd/cobbler
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.htmlExploit
- http://seclists.org/oss-sec/2014/q2/273
- http://seclists.org/oss-sec/2014/q2/274
- http://www.exploit-db.com/exploits/33252Exploit
- http://www.osvdb.org/106759
- http://www.securityfocus.com/archive/1/532094/100/0/threaded
- http://www.securityfocus.com/bid/67277
- https://github.com/cobbler/cobbler/issues/939
- https://www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.beExploit
- http://packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.htmlExploit
- http://seclists.org/oss-sec/2014/q2/273
- http://seclists.org/oss-sec/2014/q2/274
- http://www.exploit-db.com/exploits/33252Exploit
- http://www.osvdb.org/106759
- http://www.securityfocus.com/archive/1/532094/100/0/threaded
- http://www.securityfocus.com/bid/67277
- https://github.com/cobbler/cobbler/issues/939
- https://www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.beExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.