Puppet Puppet Enterprise
16 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-5309 | 2021.7.0 – < 2021.7.6 ; 2023.0.0 – < 2023.5 | Broken Session Management in Puppet Enterprise | CRITICAL 9.8 | 0.5 % | ||
| CVE-2023-5255 | Puppet Enterprise 2023.3 – 2023.4 ; Puppet Server 8.2.0 – 8.2.3 | Denial of Service for Revocation of Auto Renewed Certificates | HIGH 7.5 | 0.5 % | ||
| CVE-2023-2530 | 2021.7.0 – < 2021.7.4 ; 2023.0.0 – < 2023.2.0 | A privilege escalation allowing remote code execution was discovered in the orchestration service. | CRITICAL 9.8 | 1.1 % | ||
| CVE-2023-1894 | 2021.7.1 – < 2021.7.3 ; 2023.0.0 – < 2023.1.0 | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to speci | MEDIUM 5.3 | 0.4 % | ||
| CVE-2018-11749 | 2018.1.3 ; 2017.3.9 ; 2016.4.14 | When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. T | CRITICAL 9.8 | 0.8 % | ||
| CVE-2018-6511 | 2017.3.x – < 2017.3.6 | XSS Vulnerability in Puppet Enterprise Console | MEDIUM 5.4 | 0.6 % | ||
| CVE-2018-6510 | 2017.3.x – < 2017.3.6 | XSS Vulnerability in Puppet Enterprise Console | MEDIUM 5.4 | 0.5 % | ||
| CVE-2018-6508 | 2017.3.x prior to 2017.3.4 | Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the fa | HIGH 8.0 | 1.9 % | ||
| CVE-2017-10690 | 2017.3.x prior to 2017.3.4 | In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retri | MEDIUM 6.5 | 1.0 % | ||
| CVE-2017-10689 | prior to 2016.4.10 or 2017.3.4 | In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 inc | MEDIUM 5.5 | 0.4 % | ||
| CVE-2017-2297 | 2016.4.x prior to 2016.4.5, 2016.5.x, 2017.1.x | Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. | HIGH 7.5 | 0.6 % | ||
| CVE-2017-2296 | 2017.1.x, 2017.2.1. Fixed in 2017.2.2 | In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group na | MEDIUM 6.5 | 0.9 % | ||
| CVE-2017-2293 | prior to 2016.4.5, 2016.5.x, 2017.1.x, resolved in 2016.4.5 and 2017.2.1 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to ins | MEDIUM 4.9 | 0.7 % | ||
| CVE-2016-5716 | PE < 2016.4.0 | The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code ex | HIGH 8.8 | 1.8 % | ||
| CVE-2017-2294 | PE prior to 2016.4.5 or 2017.2.1 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in | HIGH 7.5 | 1.2 % | ||
| CVE-2016-9686 | 2015.3.x ; 2016.x prior to 2016.4.3 ; 2016.5.1. | The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Brok | MEDIUM 5.3 | 1.3 % |