CVE-2018-10931
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 67.78%
- CWE
- CWE-749
- Published
- 2018-08-09
- Last modified
- 2026-03-14
Affected products
- The Cobbler Project cobbler
Weakness type
Related vulnerabilities
- CVE-2023-27363 — Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability
- CVE-2023-38124 — Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability
- CVE-2023-51581 — Voltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
- CVE-2023-51575 — Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
- CVE-2021-34996 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.
- CVE-2023-51582 — Voltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
- CVE-2023-44414 — D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability
- CVE-2026-30957 — OneUptime Synthetic Monitor RCE via exposed Playwright browser object