Vulnerability Name:

CVE-2018-1000225 (CCN-148752)

Assigned:2018-08-02
Published:2018-08-02
Updated:2018-10-19
Summary:Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
5.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
5.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:H/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2018-1000225

Source: XF
Type: UNKNOWN
cobbler-cve20181000225-xss(148752)

Source: CCN
Type: cobbler GIT Repository
Persistent XSS vulnerability in cobbler-web [CVE-2018-1000225] #1917

Source: CONFIRM
Type: Third Party Advisory
https://github.com/cobbler/cobbler/issues/1917

Source: MISC
Type: Third Party Advisory
https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2018-1000225

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cobblerd:cobbler:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:cobbler_project:cobbler:2.6.11:*:*:*:*:*:*:*
  • OR cpe:/a:michael_dehaan:cobbler:2.0.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20181000225
    V
    		CVE-2018-1000225
    2022-06-30
    oval:org.opensuse.security:def:112087
    P
    		cobbler-3.2.1.336+git.5639a3af-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:59841
    P
    		Security update for mariadb (Moderate)
    2021-12-30
    oval:org.opensuse.security:def:60434
    P
    		Security update for bcm43xx-firmware (Important)
    2021-12-13
    oval:org.opensuse.security:def:105629
    P
    		cobbler-3.2.1.336+git.5639a3af-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:59541
    P
    		Security update for gtk-vnc (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:60352
    P
    		Security update for file (Important)
    2021-09-02
    oval:org.opensuse.security:def:60256
    P
    		Security update for djvulibre (Important)
    2021-05-19
    oval:org.opensuse.security:def:58929
    P
    		Security update for opensc (Moderate)
    2021-03-31
    oval:org.opensuse.security:def:58930
    P
    		Security update for MozillaFirefox (Important)
    2021-03-31
    oval:org.opensuse.security:def:60472
    P
    		Security update for the Linux Kernel (Important)
    2021-03-09
    oval:org.opensuse.security:def:96468
    P
    		Security update for cobbler (Moderate)
    2021-01-14
    oval:org.opensuse.security:def:109815
    P
    		Security update for cobbler (Moderate)
    2021-01-14
    oval:org.opensuse.security:def:103158
    P
    		Security update for cobbler (Moderate)
    2021-01-14
    oval:org.opensuse.security:def:11200
    P
    		Security update for cobbler (Moderate)
    2021-01-14
    oval:org.opensuse.security:def:111282
    P
    		Security update for cobbler (Moderate)
    2021-01-11
    oval:org.opensuse.security:def:59108
    P
    		Security update for the Linux Kernel (Live Patch 29 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:60511
    P
    		pigz on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59360
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60589
    P
    		Security update for cobbler (Important)
    2020-12-01
    oval:org.opensuse.security:def:60140
    P
    		Security update for the Linux Kernel (Live Patch 32 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:58952
    P
    		Security update for graphite2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60561
    P
    		update-alternatives on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:59656
    P
    		Security update for libX11 (Important)
    2020-12-01
    oval:org.opensuse.security:def:83855
    P
    		Security update for cobbler (Important)
    2018-08-30
    oval:com.ubuntu.trusty:def:20181000225000
    V
    		CVE-2018-1000225 on Ubuntu 14.04 LTS (trusty) - medium.
    2018-08-20
    oval:com.ubuntu.xenial:def:20181000225000
    V
    		CVE-2018-1000225 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-08-20
    oval:com.ubuntu.xenial:def:201810002250000000
    V
    		CVE-2018-1000225 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-08-20
    BACK
    cobblerd cobbler *
    cobbler_project cobbler 2.6.11
    michael_dehaan cobbler 2.0.0