Upstream information
Description
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having important severity.
National Vulnerability Database | |
---|---|
Base Score | 8.5 |
Vector | AV:N/AC:M/Au:S/C:C/I:C/A:C |
Access Vector | Network |
Access Complexity | Medium |
Authentication | Single |
Confidentiality Impact | Complete |
Integrity Impact | Complete |
Availability Impact | Complete |
SUSE Timeline for this CVE
CVE page created: Tue Jul 9 17:17:03 2013CVE page last modified: Mon Feb 13 11:28:51 2023