CVE-2021-45082

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.suse.com/show_bug.cgi?id=1193678Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/cobbler/cobbler/releasesRelease Notes, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEJN7CPW6YCHBFQPFZKGA6AVA6T5NPIW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE/
https://bugzilla.suse.com/show_bug.cgi?id=1193678Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/cobbler/cobbler/releasesRelease Notes, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEJN7CPW6YCHBFQPFZKGA6AVA6T5NPIW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE/

Timeline

Published: Feb 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-450837.1An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive informa CVE-2021-450856.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a CVE-2021-450866.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name val CVE-2021-450876.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by CVE-2021-450886.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.CVE-2021-450895.2Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.CVE-2021-450909.8Stormshield Endpoint Security before 2.1.2 allows remote code execution.CVE-2021-450914.3Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.CVE-2021-450929.8Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath paramete CVE-2021-450945.4Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.CVE-2021-450955.5pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.CVE-2021-450964.3KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730