CVE-2018-10931

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 68.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-09 · updated 2026-06-17
Weakness: CWE-749

Description

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.

Affected products

The cobbler Project cobbler: from 2.6.0 through 2.6.11
Red Hat Satellite 6: 5.6, 5.7, 5.8

References

https://access.redhat.com/errata/RHSA-2018:2372
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10931
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5Q4ACIVZ5D4KSUDLGRTOKGGB4U42SD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMWK5KCCZXOGOYNR2H6BWDSABTQ5NYJA/
https://access.redhat.com/errata/RHSA-2018:2372
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10931
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5Q4ACIVZ5D4KSUDLGRTOKGGB4U42SD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMWK5KCCZXOGOYNR2H6BWDSABTQ5NYJA/

Get alerted when CVE-2018-10931 or the next vulnerability affects your stack