CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-47533
Critical (9.8). EPSS 4.0% chance of exploitation in the next 30 days. Fixed in cobbler 3.2.3, 3.3.7.
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.
Severity
- EPSS
- 4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m26c-fcgh-cp6h | PyPI | cobbler | >=3.3.0 <3.3.7 | 3.3.7 |
| GHSA-m26c-fcgh-cp6h | PyPI | cobbler | >=3.0.0 <3.2.3 | 3.2.3 |
| PYSEC-2026-316 | PyPI | cobbler | >=3.0.0 <3.2.3 >=3.3.0 <3.3.7 | 3.2.3, 3.3.7 |