CVE-2008-6954 (GCVE-0-2008-6954)
Vulnerability from cvelistv5
Published
2009-08-12 10:00
Modified
2024-08-07 11:49
Severity ?
CWE
  • n/a
Summary
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:49:02.653Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2008-9723",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html"
          },
          {
            "name": "50291",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/50291"
          },
          {
            "name": "FEDORA-2008-9745",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html"
          },
          {
            "name": "32804",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32804"
          },
          {
            "name": "32737",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32737"
          },
          {
            "name": "cobbler-interface-code-execution(46625)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46625"
          },
          {
            "name": "32317",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32317"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://freshmeat.net/projects/cobbler/releases/288374"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-11-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2008-9723",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html"
        },
        {
          "name": "50291",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/50291"
        },
        {
          "name": "FEDORA-2008-9745",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html"
        },
        {
          "name": "32804",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32804"
        },
        {
          "name": "32737",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32737"
        },
        {
          "name": "cobbler-interface-code-execution(46625)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46625"
        },
        {
          "name": "32317",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32317"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://freshmeat.net/projects/cobbler/releases/288374"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-6954",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2008-9723",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html"
            },
            {
              "name": "50291",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/50291"
            },
            {
              "name": "FEDORA-2008-9745",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html"
            },
            {
              "name": "32804",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32804"
            },
            {
              "name": "32737",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32737"
            },
            {
              "name": "cobbler-interface-code-execution(46625)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46625"
            },
            {
              "name": "32317",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32317"
            },
            {
              "name": "http://freshmeat.net/projects/cobbler/releases/288374",
              "refsource": "CONFIRM",
              "url": "http://freshmeat.net/projects/cobbler/releases/288374"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-6954",
    "datePublished": "2009-08-12T10:00:00",
    "dateReserved": "2009-08-11T00:00:00",
    "dateUpdated": "2024-08-07T11:49:02.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2008-6954\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-08-12T10:30:00.877\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.\"},{\"lang\":\"es\",\"value\":\"La interfaz web en Cobbler (CobblerWeb) anterior a v1.29, permite a usuarios autenticados remotamente ejecutar c\u00f3digo Python de su elecci\u00f3n en cobblerd, mediante la edici\u00f3n de la plantilla \\\"Cheetah kickstart\\\" a los m\u00f3dulos \\\"import Python\\\" arbitrarios.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:C/A:C\",\"baseScore\":9.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.2.8\",\"matchCriteriaId\":\"D2918B32-247E-482A-B0A7-4FAE6D6D6DFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.1.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FFB6CA1-8DE6-46A2-B651-9185B5C3F2A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F56967E4-ED40-41BF-9C91-7954A010AF63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2572B0E1-B53E-4321-AEFF-9693BDB4BDEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8E6FA453-E023-4F97-A8D8-AF237E380388\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"627B0E5A-ADCC-42BD-BB59-AEF9E644DACE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B59B8107-434B-4840-AC71-7F8C5B49DAB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.2.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D040E2B-7C70-4472-BC3D-05E3A3ED3737\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.2.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E9F8A0A-64A8-485D-A9D7-D7AC21DFF72D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F63C6E4-14DD-4478-8BAA-339AD0ACCD62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04B41068-0E9E-4E07-BB13-F36DAEE72FCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E229C4C-B695-4206-ACBB-F5CC650839B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"853B8AF2-A457-4B55-BF75-DB9D8DE223B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AC609A3-8BEC-434D-B54D-35C37D1D1F49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"084D307A-8D04-4CA6-8578-671DEE947F25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.3.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6FCE8A70-8380-4B3D-B21B-5DC4DE89BA44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.3.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEFF3158-173F-49A7-83A7-A81B4FC01415\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0619FD9-7B6D-4DCB-ABFF-F88836929A2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DCE6AEA-64C4-4C14-B86B-3C23DCA1681D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.4.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1E8A8A7-2C7F-4472-8325-F084422EF292\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.4.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"309F7F4F-FDA3-4DDB-ADC9-3B3FBCB1EC4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.4.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D63C65-AB90-4333-B65A-01E8169B5949\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.4.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"841920B9-7D97-4307-B26B-A4CC8719D1CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.4.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDB39A4A-3E43-4136-81CD-B60794EC404E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07589167-C139-41FF-903E-9368C614F782\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63A5A98D-B58F-49BD-B592-ADF7C24B2914\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6422638-6A04-4C78-A2EE-A2EF306EC437\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BF19E29-9CA7-4020-9493-37F1303D1872\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"370D7F49-D17C-4E15-B32E-EB70B7132073\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44F6519E-D036-4C98-A801-0C7BFAD5D83A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"34821A36-4C63-40BA-B45F-0C7B6B6D2455\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:0.8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96CA84D7-1B4B-4C07-8743-9D1B291A9EDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E173676-83B1-44FE-9739-CA46FDE94944\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F114D84-0D39-47B1-B337-A2616E672346\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.0.2-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDFDEAC9-E8AC-4597-A584-A5989F11BE04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.0.3-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB865F95-A38D-4A67-8219-AA74946F4571\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90C6F857-41DD-46E4-9D58-DF95EF2D0711\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1347D094-2161-4FAA-9208-4EAB6E6E5A81\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5ED95EDC-D6A6-4011-908E-E9540B708651\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C225ECD-81C9-45CF-AAD2-51C1093DCBA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC4E3814-CC61-4777-8560-BD942EECED66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:michael_dehaan:cobbler:1.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"392DF7EC-212D-4EF1-ABE8-72FC4A3788AD\"}]}]}],\"references\":[{\"url\":\"http://freshmeat.net/projects/cobbler/releases/288374\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://osvdb.org/50291\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/32737\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/32804\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/32317\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/46625\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://freshmeat.net/projects/cobbler/releases/288374\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://osvdb.org/50291\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/32737\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/32804\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/32317\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/46625\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.