CVE-2021-45083: Cobbler Project Cobbler

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.

Affected products

• Cobbler Project Cobbler: before 3.3.1 (fixed in 3.3.1)
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only

Published 2022-02-20. Last modified 2026-06-17.