CVE-2012-2395: Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute a...

Security readout for executives and security teams

CVE-2012-2395 is a command injection flaw in Cobbler 2.2.0. A remote attacker could abuse username or password fields in a power-management XML-RPC method to make the server run unintended commands. This matters most where Cobbler manages provisioning infrastructure and its XML-RPC API is reachable. Exposure is likely limited to environments running Cobbler 2.2.0 or affected packaged builds, especially where the XML-RPC API is reachable by untrusted networks or users. The bundle does not identify broader product versions beyond Cobbler 2.2.0. Treat as high priority if Cobbler is present in provisioning or infrastructure-management environments. The issue can lead to command execution on management systems, but urgency depends on whether affected versions remain deployed and whether XML-RPC is reachable. Mitigation focus: Apply vendor-provided Cobbler updates from SUSE/openSUSE or the relevant upstream fix.; Restrict Cobbler XML-RPC API access to trusted management networks only.; Remove or upgrade Cobbler 2.2.0 where it remains in use..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.