CVE-2012-2395: Michael Dehaan Cobbler

High severity, CVSS 7.5. EPSS: 5.6% chance of exploitation in the next 30 days.

Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

Affected products

• Michael Dehaan Cobbler: version 2.2.0 only

Published 2012-06-16. Last modified 2026-06-16.