← Vulnerability feed

Vulnerability record · CVE-2011-4953 · published 27 October 2014

CVE-2011-4953: Cobbler project cobbler improper input validation vulnerability

Cobbler Project · Cobbler

The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.

6.8 CVSS 2.0 Medium EPSS 2.2% · top 18.3% CWE-20 · Improper input validation
6.8CVSS 2.0 base score
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
16 Jun 2026Last modified by NVD

Description

The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00019.html
https://bugs.launchpad.net/ubuntu/oneiric/+source/cobbler/+bug/858883
https://bugzilla.novell.com/show_bug.cgi?id=757062
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00019.html
https://bugs.launchpad.net/ubuntu/oneiric/+source/cobbler/+bug/858883
https://bugzilla.novell.com/show_bug.cgi?id=757062

Track CVE-2011-4953 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-40323Cobbler XMLRPC log poisoning leads to remote code executionCobbler before 3.3.0 allows log poisoning through an XMLRPC method that writes attacker-controlled input into the logfile, which is then processed as…EPSS 87%analysed9.8CVE-2018-10931Cobbler XMLRPC interface exposes privileged functions to unauthenticated usersCobbler 2.6.x exposes all functions of its CobblerXMLRPCInterface class over XMLRPC, so the interface is reachable without authentication. A remote a…EPSS 68%analysed9.8CVE-2017-1000469Cobbler project cobbler improper input validation vulnerabilityCobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as r…EPSS 5.6%9.1CVE-2022-0860Cobbler project cobbler improper authorization vulnerabilityImproper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.EPSS 2.3%7.8CVE-2021-45082Cobbler project cobbler command injection vulnerabilityAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Pyth…EPSS 0.50%7.5CVE-2021-40324Cobbler upload_log_data arbitrary file writeCobbler before 3.3.0 allows arbitrary file write operations through the upload_log_data function. Because the flaw is an unrestricted file upload (CW…EPSS 69%analysed7.5CVE-2021-40325Cobbler project cobbler vulnerabilityCobbler before 3.3.0 allows authorization bypass for modification of settings.EPSS 1.4%7.1CVE-2021-45083Cobbler project cobbler incorrect default permissions vulnerabilityAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that…EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2011-4953), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.