Cobbler
23 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Cobbler, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Cobbler CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 1 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 23 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical7
- High10
- Medium6
Latest CVEs
The 15 most recently published vulnerabilities affecting Cobbler.
- CVE-2024-47533Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes9.8
- CVE-2022-0860Improper Authorization in cobbler/cobbler9.1
- CVE-2021-45083An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-priv...7.1
- CVE-2021-45081An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.5.9
- CVE-2021-45082An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substri...7.8
- CVE-2021-40325Cobbler before 3.3.0 allows authorization bypass for modification of settings.7.5
- CVE-2021-40324Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.7.5
- CVE-2021-40323Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.9.8
- CVE-2012-2092A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.5.9
- CVE-2011-4954cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE7.8
- CVE-2011-4952cobbler: Web interface lacks CSRF protection when using Django framework8.8
- CVE-2016-9605A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigati...6.1
- CVE-2018-1000226Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control v...9.8
- CVE-2018-1000225Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS)...6.1
- CVE-2018-10931It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobble...9.8
Product grouping is registry-driven, with AI assist and human review. How it works