Incorrect Permission Assignment for Critical Resource Affecting cobbler package, versions <2.4.1-0ubuntu2+esm1


Severity

Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
72.82% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1604-COBBLER-1195986
  • published23 Jul 2025
  • disclosed20 Aug 2018

Introduced: 20 Aug 2018

CVE-2018-1000226  (opens in a new tab)
CWE-732  (opens in a new tab)

How to fix?

Upgrade Ubuntu:16.04 cobbler to version 2.4.1-0ubuntu2+esm1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cobbler package and not the cobbler package as distributed by Ubuntu. See How to fix? for Ubuntu:16.04 relevant fixed versions and status.

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.