| Vulnerability Name: | CVE-2014-3225 (CCN-93033) | ||||||||||||||||||||||||||||||||
| Assigned: | 2014-05-08 | ||||||||||||||||||||||||||||||||
| Published: | 2014-05-08 | ||||||||||||||||||||||||||||||||
| Updated: | 2018-10-09 | ||||||||||||||||||||||||||||||||
| Summary: | Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile. | ||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N) 3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:U/RC:UR)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:U/RC:UR)
| ||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-22 | ||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||
| References: | Source: CCN Type: Cobbler Web site Cobbler Source: MITRE Type: CNA CVE-2014-3225 Source: MISC Type: Exploit http://packetstormsecurity.com/files/126553/Cobbler-Local-File-Inclusion.html Source: MLIST Type: UNKNOWN [oss-security] 20140508 CVE Request - Local File inclusion in Cobbler Source: MLIST Type: UNKNOWN [oss-security] 20140508 Re: CVE Request - Local File inclusion in Cobbler Source: EXPLOIT-DB Type: Exploit 33252 Source: OSVDB Type: UNKNOWN 106759 Source: CCN Type: OSVDB ID: 106759 Cobbler WebUI Profile Creation Kickstart Value Absolute Path Traversal Remote File Disclosure Source: BUGTRAQ Type: UNKNOWN 20140513 FD - Cobbler Arbitrary File Read CVE-2014-3225 Source: BID Type: UNKNOWN 67277 Source: CCN Type: BID-67277 Cobbler 'Kickstart' Value Local File Include Vulnerability Source: XF Type: UNKNOWN cobbler-cve20143225-file-include(93033) Source: MISC Type: UNKNOWN https://github.com/cobbler/cobbler/issues/939 Source: CCN Type: Packet Storm Security [05-08-2014] Cobbler Local File Inclusion Source: EXPLOIT-DB Type: EXPLOIT Offensive Exploit Database [05-08-2014] Source: CCN Type: WhiteSource Vulnerability Database CVE-2014-3225 Source: MISC Type: Exploit https://www.youtube.com/watch?v=vuBaoQUFEYQ&feature=youtu.be | ||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||