← Vulnerability feed

Vulnerability record · CVE-2021-40325 · published 4 October 2021

CVE-2021-40325: Cobbler project cobbler vulnerability

Cobbler Project · Cobbler

Cobbler before 3.3.0 allows authorization bypass for modification of settings.

7.5 CVSS 3.1 High EPSS 1.4% · top 28.5%
7.5CVSS 3.1 base score, v2 5.0
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Cobbler before 3.3.0 allows authorization bypass for modification of settings.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a PatchThird Party Advisory
https://github.com/cobbler/cobbler/releases/tag/v3.3.0 ProductThird Party Advisory
https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a PatchThird Party Advisory
https://github.com/cobbler/cobbler/releases/tag/v3.3.0 ProductThird Party Advisory

Track CVE-2021-40325 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-40323Cobbler XMLRPC log poisoning leads to remote code executionCobbler before 3.3.0 allows log poisoning through an XMLRPC method that writes attacker-controlled input into the logfile, which is then processed as…EPSS 87%analysed9.8CVE-2018-10931Cobbler XMLRPC interface exposes privileged functions to unauthenticated usersCobbler 2.6.x exposes all functions of its CobblerXMLRPCInterface class over XMLRPC, so the interface is reachable without authentication. A remote a…EPSS 68%analysed9.8CVE-2017-1000469Cobbler project cobbler improper input validation vulnerabilityCobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as r…EPSS 5.6%9.1CVE-2022-0860Cobbler project cobbler improper authorization vulnerabilityImproper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.EPSS 2.3%7.8CVE-2021-45082Cobbler project cobbler command injection vulnerabilityAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Pyth…EPSS 0.50%7.5CVE-2021-40324Cobbler upload_log_data arbitrary file writeCobbler before 3.3.0 allows arbitrary file write operations through the upload_log_data function. Because the flaw is an unrestricted file upload (CW…EPSS 69%analysed7.1CVE-2021-45083Cobbler project cobbler incorrect default permissions vulnerabilityAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that…EPSS 0.31%6.8CVE-2011-4953Cobbler project cobbler improper input validation vulnerabilityThe set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related …EPSS 2.2%

Source: NIST National Vulnerability Database (record CVE-2021-40325), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.