GHSA-xc7w-jvhx-p6q9

Source

https://github.com/advisories/GHSA-xc7w-jvhx-p6q9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xc7w-jvhx-p6q9/GHSA-xc7w-jvhx-p6q9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xc7w-jvhx-p6q9

Aliases

CVE-2014-3225
PYSEC-2026-797

Published

2022-05-14T02:52:42Z

Modified

2026-07-07T11:56:27Z

Summary

Cobbler Path Traversal vulnerability

Details

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-04-08T18:58:54Z",
    "nvd_published_at":  "2014-05-14T00:55:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / cobbler

Package

Name: cobbler; View open source insights on deps.dev
Purl: pkg:pypi/cobbler

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.6.0

Fixed

2.6.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xc7w-jvhx-p6q9/GHSA-xc7w-jvhx-p6q9.json"

PyPI / cobbler

Package

Name: cobbler; View open source insights on deps.dev
Purl: pkg:pypi/cobbler

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Fixed

2.4.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xc7w-jvhx-p6q9/GHSA-xc7w-jvhx-p6q9.json"