CVE-2024-47533
Fixed in a distro release EPSS 4%CVSS 9.8
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
Products: cobbler, cobbler_project cobbler
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | cobbler | 3.3.7 |
| PyPI | cobbler | 3.2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.14-150000.1.27.4 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-proxy-systemd-services | 4.3.14-150000.1.27.4 |
| SUSE Manager Proxy 4.3 | release-notes-susemanager-proxy | 4.3.14-150400.3.90.1 |
| SUSE Manager Proxy Module 4.3 | mgr-daemon | 4.3.11-150400.3.21.6 |
| SUSE Manager Proxy Module 4.3 | spacecmd | 4.3.29-150400.3.42.8 |
| SUSE Manager Proxy Module 4.3 | spacewalk-backend | 4.3.30-150400.3.47.16 |
| SUSE Manager Proxy Module 4.3 | spacewalk-certs-tools | 4.3.26-150400.3.36.7 |
| SUSE Manager Proxy Module 4.3 | spacewalk-client-tools | 4.3.21-150400.3.33.11 |
| SUSE Manager Proxy Module 4.3 | spacewalk-proxy | 4.3.19-150400.3.29.9 |
| SUSE Manager Proxy Module 4.3 | spacewalk-web | 4.3.42-150400.3.52.1 |
| SUSE Manager Proxy Module 4.3 | susemanager-build-keys | 15.4.10-150400.3.29.4 |
| SUSE Manager Proxy Module 4.3 | uyuni-common-libs | 4.3.11-150400.3.21.6 |
| SUSE Manager Proxy Module 4.3 | uyuni-proxy-systemd-services | 4.3.14-150000.1.27.4 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.14-150400.3.122.1 |
| SUSE Manager Server Module 4.3 | cobbler | 3.3.3-150400.5.52.3 |
| SUSE Manager Server Module 4.3 | grafana-formula | 0.11.0-150400.3.21.4 |
| SUSE Manager Server Module 4.3 | inter-server-sync | 0.3.5-150400.3.36.13 |
| SUSE Manager Server Module 4.3 | saltboot-formula | 0.1.1723628891.ffb1da5-150400.3.18.4 |
| SUSE Manager Server Module 4.3 | spacecmd | 4.3.29-150400.3.42.8 |
| SUSE Manager Server Module 4.3 | spacewalk-backend | 4.3.30-150400.3.47.16 |
| SUSE Manager Server Module 4.3 | spacewalk-certs-tools | 4.3.26-150400.3.36.7 |
| SUSE Manager Server Module 4.3 | spacewalk-client-tools | 4.3.21-150400.3.33.11 |
| SUSE Manager Server Module 4.3 | spacewalk-config | 4.3.14-150400.3.18.6 |
| SUSE Manager Server Module 4.3 | spacewalk-java | 4.3.82-150400.3.96.1 |
| SUSE Manager Server Module 4.3 | spacewalk-utils | 4.3.22-150400.3.29.2 |
| SUSE Manager Server Module 4.3 | spacewalk-web | 4.3.42-150400.3.52.1 |
| SUSE Manager Server Module 4.3 | susemanager | 4.3.39-150400.3.58.5 |
| SUSE Manager Server Module 4.3 | susemanager-build-keys | 15.4.10-150400.3.29.4 |
| SUSE Manager Server Module 4.3 | susemanager-docs_en | 4.3.14-150400.9.66.2 |
| SUSE Manager Server Module 4.3 | susemanager-schema | 4.3.27-150400.3.45.11 |
| SUSE Manager Server Module 4.3 | susemanager-sls | 4.3.45-150400.3.55.4 |
| SUSE Manager Server Module 4.3 | susemanager-sync-data | 4.3.21-150400.3.35.2 |
| SUSE Manager Server Module 4.3 | uyuni-common-libs | 4.3.11-150400.3.21.6 |
| SUSE Manager Server Module 4.3 | uyuni-reportdb-schema | 4.3.11-150400.3.18.12 |
| SUSE Package Hub 15 SP5 | cobbler | 3.3.7-bp155.2.3.2 |
| SUSE Package Hub 15 SP6 | cobbler | 3.3.7-bp156.2.6.1 |
| openSUSE Leap 15.5 | cobbler | 3.3.7-bp155.2.3.2 |
| openSUSE Leap 15.6 | cobbler | 3.3.7-bp156.2.6.1 |
| openSUSE Tumbleweed | cobbler | 3.3.7-1.1 |