PT-2014-5150 · Cobbler+1 · Cobbler+1
CVE-2014-3225
·
Published
2014-05-14
·
Updated
2026-07-06
CVSS v2.0
4.0
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Cobbler versions 2.4.x through 2.6.x
Description
The issue allows remote authenticated users to read arbitrary files via the Kickstart field in a profile due to an absolute path traversal vulnerability in the web interface.
Recommendations
For Cobbler versions 2.4.x through 2.6.x, consider restricting access to the Kickstart field in profiles to minimize the risk of exploitation until a patch is available.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cobbler
Ubuntu