CVE-2021-40325: 
Python vulnerability analysis and mitigation

Cobbler before version 3.3.0 contains a security vulnerability (CVE-2021-40325) that allows unauthorized users to bypass authorization controls for modifying settings. The vulnerability was disclosed on October 4, 2021, affecting all versions of Cobbler prior to 3.3.0 (NVD, GitHub Release).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and can result in high impact to integrity while not affecting confidentiality or availability (NVD).

The vulnerability allows attackers to bypass authorization controls and modify system settings. This could potentially lead to unauthorized configuration changes in the Cobbler deployment server, affecting the integrity of the system (NVD).

The vulnerability was fixed in Cobbler version 3.3.0. Users are advised to upgrade to this version or later to mitigate the security risk. The fix includes improvements to authorization controls and security-related code changes (GitHub Release).