CVE-2014-3225

描述

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

如何修補 CVE-2014-3225

要修補 CVE-2014-3225,請將受影響套件升級到下列已修補版本。

• PyPI/cobbler—升級至 2.6.4 或更新版本
• PyPI/cobbler—升級至 2.4.7 或更新版本

CVE-2014-3225 正在被利用嗎?

中等 — EPSS 為 8.8%,可持續追蹤但非最高優先。

受影響套件(2)

• >= 2.6.0, < 2.6.4
• >= 2.4.0, < 2.4.7, >= 2.6.0, < 2.6.4

參考連結(15)

• ADVISORYgithub.com/advisories/GHSA-xc7w-jvhx-p6q9
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-3225
• PATCHgithub.com/cobbler/cobbler
• PATCHpypi.org/project/cobbler
• WEBpacketstormsecurity.com