CVE-2021-40325

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Cobbler before 3.3.0 allows authorization bypass for modification of settings.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published
Oct 4, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-403265.5Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed documCVE-2021-403275.9Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto CVE-2021-403299.8The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.CVE-2021-40336.5kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-403307.5git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected crCVE-2021-403318.1An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privCVE-2021-403337.1Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data CommunicCVE-2021-403347.5Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 allows an attacker thatCVE-2021-403358.8A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent reCVE-2021-403368.8A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTCVE-2021-403375.4Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take advCVE-2021-403385.3Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path