CVE-2008-6954
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
CVE-2008-6954 is a high vulnerability (CVSS 9.0) in Michael Dehaan Cobbler, published August 12, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in cobbler 1.2.9.
- Severity
- 9.0 HighCVSS 2.0, NVD
- Exploit chance
- 2.16%EPSS, 82nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2.9cobbler +1 more
Description
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
CVE-2008-6954- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
CVE-2008-6954- Updated
- 2026-11-02
EUVDEUVD-2022-4717No score
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
EUVD-2022-4717- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p8w2-f44p-fmcjNo score
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
GHSA-p8w2-f44p-fmcj- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-p8w2-f44p-fmcjNo score
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
GHSA-p8w2-f44p-fmcj- Weakness
- CWE-94
- Updated
- 2026-11-02
OSVPYSEC-2026-795No score
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
- Record
PYSEC-2026-795- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
redhat.com/archives/fedora-package-announce/2008-November/msg00462.html
osvdb.org/50291
secunia.com/advisories/32804
exchange.xforce.ibmcloud.com/vulnerabilities/46625
Show 9 moreShow less
securityfocus.com/bid/32317
freshmeat.net/projects/cobbler/releases/288374
nvd.nist.gov/vuln/detail/CVE-2008-6954
web.archive.org/web/20111227125913/http://secunia.com/advisories/32804
github.com/advisories/GHSA-p8w2-f44p-fmcj
pypi.org/project/cobbler