CVE-2011-4952

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

cobbler: Web interface lacks CSRF protection when using Django framework

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
cobbler	cobbler	2011-09-28

References

http://www.openwall.com/lists/oss-security/2012/04/12/10Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-4952Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4952Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-4952Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/04/12/10Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-4952Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4952Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-4952Third Party Advisory

Timeline

Published: Nov 19, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-49536.8The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors CVE-2011-49547.8cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE CVE-2011-49556.1Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attacke CVE-2011-49564.3Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspec CVE-2011-49575.0The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the CVE-2011-49584.3Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows CVE-2011-49596.8SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL d CVE-2011-49607.5SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attack CVE-2011-49616.0SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT_PERMISSIONS permission to gain admin CVE-2011-49626.8code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a c CVE-2011-49635.0nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted CVE-2011-49666.0modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the passw