CVE-2024-47533

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.

• CWE-287

• https://github.com/cobbler/cobbler/commit/32c5cada013dc8daa7320a8eda9932c2814742b0
• https://github.com/cobbler/cobbler/commit/e19717623c10b29e7466ed4ab23515a94beb2dda
• https://github.com/cobbler/cobbler/security/advisories/GHSA-m26c-fcgh-cp6h

Published

Nov 18, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47528LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…4.8
• CVE-2024-47529OpenC3 COSMOS provides the functionality needed to send comm…6.5
• CVE-2024-4753The WP Secure Maintenance WordPress plugin before 1.7 does n…4.8
• CVE-2024-47530Scout is a web-based visualizer for VCF-files. Open redirect…6.1
• CVE-2024-47531Scout is a web-based visualizer for VCF-files. Due to the la…3.5
• CVE-2024-47532RestrictedPython is a restricted execution environment for P…6.5
• CVE-2024-47534go-tuf is a Go implementation of The Update Framework (TUF).…8.2
• CVE-2024-47535Netty is an asynchronous event-driven network application fr…5.5
• CVE-2024-47536Citizen is a MediaWiki skin that makes extensions part of th…5.4
• CVE-2024-47537GStreamer is a library for constructing graphs of media-hand…9.8
• CVE-2024-47538GStreamer is a library for constructing graphs of media-hand…9.8
• CVE-2024-47539GStreamer is a library for constructing graphs of media-hand…9.8