CVE-2018-10931
CriticalCobbler has Exposed Dangerous Method or Function
Published May 13, 2022 · Updated Jul 8, 2026 · Also known as GHSA-8787-63px-3m23, PYSEC-2026-313, SUSE-SU-2018:2550-1, UBUNTU-CVE-2018-10931
Key Facts
Patch immediately- CVE-2018-10931 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Cobbler (Cobbler Project), Satellite (Redhat), cobbler-tests (suse) and 2 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 68% probability of exploitation in the next 30 days.
- Fixed versions are available, including Cobbler 0:2.0.7-73.el6sat, Cobbler 2.2.2-0.68.6.1, Cobbler 2.4.1-0ubuntu2+esm1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
68%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2018-10931 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
Affected Products
37 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| CobblerCobbler Project | >= 2.6.0, >= 2.6.x | 2.6.11 |
| SatelliteRedhat | 5.6, 5.7, 5.8 | n/a |
| cobbler-testssuse | See advisory | 3.1.2-lp152.6.3.1 |
| cobbler-websuse | See advisory | 3.1.2-lp152.6.3.1 |
| koansuse | See advisory | 2.6.6-17.1 |
Patched Releases
Cobbler
0:2.0.7-73.el6sat, 2.2.2-0.68.6.1, 2.4.1-0ubuntu2+esm1, 2.6.6-17.1, 2.6.6-49.14.1, 2.6.6-5.17.1, 2.6.6-6.7.1, 3.0.0, 3.1.2-bp152.4.3.1, 3.1.2-lp152.6.3.1, 3.2.1.336+git.5639a3af-1.1, <=2.6.11
cobbler-tests
2.6.6-17.1, 3.1.2-bp152.4.3.1, 3.1.2-lp152.6.3.1, 3.2.1.336+git.5639a3af-1.1
cobbler-web
2.6.6-17.1, 3.1.2-bp152.4.3.1, 3.1.2-lp152.6.3.1
koan
2.2.2-0.68.6.1, 2.6.6-17.1, 2.6.6-49.14.1
Timeline
Publicly disclosed
May 13, 2022
Last updated
Jul 8, 2026
Weakness Type
- CWE-749 Exposed Dangerous Method or Function
References
- advisoryhttps://bugzilla.suse.com/1097733
- advisoryhttps://bugzilla.suse.com/1101670
- advisoryhttps://bugzilla.suse.com/1104189
- advisoryhttps://bugzilla.suse.com/1104190
- advisoryhttps://bugzilla.suse.com/1104287
FAQ
Common Questions.
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC.
Affected: Cobbler (Cobbler Project) versions >= 2.6.0, >= 2.6.x; Satellite (Redhat) versions 5.6, 5.7, 5.8; cobbler-tests (suse), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Cobbler 0:2.0.7-73.el6sat, Cobbler 2.2.2-0.68.6.1, Cobbler 2.4.1-0ubuntu2+esm1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-10931 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo