CVE-2018-1000226

一、漏洞信息
 漏洞编号：[CVE-2018-1000226](https://nvd.nist.gov/vuln/detail/CVE-2018-1000226)
 漏洞归属组件：[cobbler](https://gitee.com/src-openeuler/cobbler)
 漏洞归属的版本：3.2.0
 CVSS V3.0分值：
  BaseScore：9.8 Critical
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via  network connectivity . Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
 漏洞公开时间：2018-08-21 04:29
 漏洞创建时间：2022-08-15 19:35:45
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000226
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| MISC | https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/ |  |
| CONFIRM | https://github.com/cobbler/cobbler/issues/1916 |  |
| redhat | https://access.redhat.com/security/cve/CVE-2018-1000226 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  cobbler中包含一个不正确的访问控制漏洞，该漏洞可能导致特权升级、数据操纵或渗漏、LDAP 凭据收集。这种攻击可以通过“网络连接”加以利用。根据上游社区修复补丁，该CVE在3.2.0版本已经修复，故当前版本不涉及
 openEuler评分：
  9.8
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP1(3.2.0):不受影响
2.openEuler-20.03-LTS-SP3(3.2.0):不受影响
3.openEuler-22.03-LTS(3.2.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(3.2.0):否
2.openEuler-20.03-LTS-SP3(3.2.0):否
3.openEuler-22.03-LTS(3.2.0):否
4.openEuler-22.09(3.2.0):否

src-openEuler/cobbler

内容风险标识

评论 (7)

src-openEuler/cobbler .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2018-1000226

评论 (7)

搜索帮助

src-openEuler/cobbler