CVE-2018-1000225: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 14, 2022 (updated July 25, 2023)

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via “network connectivity”. Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).

References

github.com/advisories/GHSA-q9g5-98pm-w6q7
github.com/cobbler/cobbler/issues/1917
movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/
nvd.nist.gov/vuln/detail/CVE-2018-1000225

Code Behaviors & Features

Detect and mitigate CVE-2018-1000225 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →