Critical severity · published Jun 10, 2016
CVE-2016-2785
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access…
9.8
CVSS
2.9%
EPSS
No
On KEV
Description
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Puppet · Puppet
4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.1.0; 4.2.0; +8 more · source: NVD
PA
Puppet Agent · Puppet
1.4.1 · source: NVD
PS
Puppet Server · Puppet
2.0.0; 2.1.0; 2.1.1; 2.1.2; 2.2.0; 2.3.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2785
Vendor Advisory
https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2
Vendor Advisory
https://puppet.com/security/cve/cve-2016-2785
Third Party Advisory
https://security.gentoo.org/glsa/201606-02
More from Puppet
8.8
CVE-2021-27021
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query
8.8
CVE-2018-6513
Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13,…
8.2
CVE-2017-2295
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format
7.8
CVE-2018-6515
Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an…
7.8
CVE-2018-6514
In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which…