Executive brief
Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
Affected products
- PyPI cobbler
Junglewise Threat Intelligence
CVE-2021-40323: PYSEC-2021-373 - Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template i
CVE-2021-40323 · Severity: low · CVSS 3.1 · Published 2021-10-04
Technologies: cobbler (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-794 - Cobbler is vulnerable to code injection
- PYSEC-2026-792 - Cobbler subject to Command Injection
- PYSEC-2026-793 - Cobbler vulnerable to code injection via unsafe YAML loading
- PYSEC-2026-795 - Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
- PYSEC-2026-797 - Cobbler Path Traversal vulnerability