CVE-2021-40323

Description

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

How to fix CVE-2021-40323

To remediate CVE-2021-40323, upgrade the affected package to a fixed version below.

• PyPI/cobbler—upgrade to 3.3.0 or later
• PyPI/cobbler—upgrade to d8f60bbf14a838c8c8a1dba98086b223e35fe70a or later

Is CVE-2021-40323 being exploited?

Likely — EPSS is 93.2%, placing CVE-2021-40323 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (2)

• from 0, < 3.3.0
• from 0, < d8f60bbf14a838c8c8a1dba98086b223e35fe70a | from 0, < 3.3.0

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-cpqf-3c3r-c9g2
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-40323
• PATCHgithub.com/cobbler/cobbler
• WEBgithub.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a
• WEB