← Vulnerability feed

Vulnerability record · CVE-2017-1000469 · published 3 January 2018

CVE-2017-1000469: Cobbler project cobbler improper input validation vulnerability

Cobbler Project · Cobbler

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.

9.8 CVSS 3.0 Critical EPSS 5.6% · top 7.4% CWE-20 · Improper input validation
9.8CVSS 3.0 base score, v2 10.0
5.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/cobbler/cobbler/issues/1845 ExploitMitigationThird Party Advisory
https://github.com/cobbler/cobbler/issues/1845 ExploitMitigationThird Party Advisory

Track CVE-2017-1000469 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-40323Cobbler XMLRPC log poisoning leads to remote code executionCobbler before 3.3.0 allows log poisoning through an XMLRPC method that writes attacker-controlled input into the logfile, which is then processed as…EPSS 87%analysed9.8CVE-2018-10931Cobbler XMLRPC interface exposes privileged functions to unauthenticated usersCobbler 2.6.x exposes all functions of its CobblerXMLRPCInterface class over XMLRPC, so the interface is reachable without authentication. A remote a…EPSS 68%analysed9.1CVE-2022-0860Cobbler project cobbler improper authorization vulnerabilityImproper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.EPSS 2.3%7.8CVE-2021-45082Cobbler project cobbler command injection vulnerabilityAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Pyth…EPSS 0.50%7.5CVE-2021-40324Cobbler upload_log_data arbitrary file writeCobbler before 3.3.0 allows arbitrary file write operations through the upload_log_data function. Because the flaw is an unrestricted file upload (CW…EPSS 69%analysed7.5CVE-2021-40325Cobbler project cobbler vulnerabilityCobbler before 3.3.0 allows authorization bypass for modification of settings.EPSS 1.4%7.1CVE-2021-45083Cobbler project cobbler incorrect default permissions vulnerabilityAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that…EPSS 0.31%6.8CVE-2011-4953Cobbler project cobbler improper input validation vulnerabilityThe set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related …EPSS 2.2%

Source: NIST National Vulnerability Database (record CVE-2017-1000469), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.