Medium severity6.1NVD Advisory· Published Aug 20, 2018· Updated Jun 17, 2026
CVE-2018-1000225
CVE-2018-1000225
Description
Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
cobblerPyPI | <= 2.6.11 | — |
Affected products
12- ghsa-coords12 versionspkg:pypi/cobblerpkg:rpm/opensuse/cobbler&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/cobbler&distro=openSUSE%20Tumbleweedpkg:rpm/suse/cobbler&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/cobbler&distro=SUSE%20Manager%20Client%20Tools%2012pkg:rpm/suse/cobbler&distro=SUSE%20Manager%20Server%203.0pkg:rpm/suse/cobbler&distro=SUSE%20Manager%20Server%203.1pkg:rpm/suse/cobbler&distro=SUSE%20Manager%20Server%203.2pkg:rpm/suse/cobbler&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/cobbler&distro=SUSE%20Package%20Hub%2015%20SP2pkg:rpm/suse/release-notes-susemanager&distro=SUSE%20Manager%20Server%203.1pkg:rpm/suse/release-notes-susemanager-proxy&distro=SUSE%20Manager%20Proxy%203.1
<= 2.6.11+ 11 more
- (no CPE)range: <= 2.6.11
- (no CPE)range: < 3.1.2-lp152.6.3.1
- (no CPE)range: < 3.2.1.336+git.5639a3af-1.1
- (no CPE)range: < 2.6.6-49.14.1
- (no CPE)range: < 2.6.6-49.14.1
- (no CPE)range: < 2.6.6-49.14.1
- (no CPE)range: < 2.6.6-5.17.1
- (no CPE)range: < 2.6.6-6.7.1
- (no CPE)range: < 2.6.6-49.14.1
- (no CPE)range: < 3.1.2-bp152.4.3.1
- (no CPE)range: < 3.1.8-5.38.1
- (no CPE)range: < 3.1.8-0.15.29.1
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-q9g5-98pm-w6q7ghsaADVISORY
- github.com/cobbler/cobbler/issues/1917nvdThird Party AdvisoryWEB
- movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/nvdThird Party Advisory
- nvd.nist.gov/vuln/detail/CVE-2018-1000225ghsaADVISORY
- github.com/cobbler/cobbler/blob/master/cobbler/remote.pyghsaWEB
- movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-apighsaWEB
News mentions
0No linked articles in our index yet.