CWE Code: 79
Vulnerability Type: privilege_escalation
CVSS Score: 4.3
CWE Name:  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary: cobbler version verified as present in cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a cross site scripting (xss) vulnerability in cobbler-web that can result in privilege escalation to admin.. this attack appear to be exploitable via "network connectivity". sending unauthenticated javascript payload to the cobbler xmlrpc api (/cobbler_api).
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2018-08-20
Last Modified Date: 2018-10-19