NVD

Id
13717  
Name
CVE-2010-2235  
Description
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.  
Reject
 
CVSS Version
2  
CVSS Score
8.5  
Severity
High  
CVSS Base Score
8.5  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2010-12-09  
Modified Date
2010-12-10  
Seq
2010-2235  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
76254 13717 CVE-2010-2235 http://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz  View
76255 13717 CVE-2010-2235 RHSA-2010:0775  View
76256 13717 CVE-2010-2235 https://bugzilla.redhat.com/show_bug.cgi?id=607662  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
37156 JVNDB-2010-002941 Red Hat Network Satellite Server の Cobbler における任意のコードを実行される脆弱性 Red Hat Network Satellite Server の Cobbler のtemplate_api.py は、Cheetah テンプレートエンジンが持つ テンプレート内に含まれる Python 命令文の実行権限を無効にしないため、任意のコードを実行される脆弱性が存在します。 CVE-2010-2235 44815 CVE-2010-2235 13717 8.5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002941.html 2010-10-18 2012-03-27 View