Cobbler 'Kickstart' Value Local File Include Vulnerability
BID:67277
Info
Cobbler 'Kickstart' Value Local File Include Vulnerability
| Bugtraq ID: | 67277 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-3225 |
| Remote: | Yes |
| Local: | No |
| Published: | May 08 2014 12:00AM |
| Updated: | Apr 13 2015 09:45PM |
| Credit: | Dolev Farhi |
| Vulnerable: |
Cobbler Project Cobbler 0 |
| Not Vulnerable: | |
Discussion
Cobbler 'Kickstart' Value Local File Include Vulnerability
Cobbler is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input before being used to include files.
An attacker can exploit this issue using directory-traversal strings to view files and execute local script code in the context of the web server process. This may allow the attacker to compromise the application; other attacks are also possible.
Cobbler is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input before being used to include files.
An attacker can exploit this issue using directory-traversal strings to view files and execute local script code in the context of the web server process. This may allow the attacker to compromise the application; other attacks are also possible.
Solution / Fix
Cobbler 'Kickstart' Value Local File Include Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].