PE
Product
Puppet Enterprise
89
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 14Medium 21Low 0
Watch
Add Puppet Enterprise to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-5459 | 8.8 | Jun 26 | A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host Affected: 2018.1.8 before 2023.8.4; 2025.3.0 |
| CVE-2021-27020 | 8.8 | Aug 30 | Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export Affected: before 2019.8.6 |
| CVE-2021-27021 | 8.8 | Jul 20 | A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query Affected: before 2019.8.7; 2021.0.0 before 2021.2.0 |
| CVE-2015-5686 | 8.8 | Feb 27 | Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks Affected: 3.0.0 before 2015.2.0 |
| CVE-2018-6513 | 8.8 | Jun 11 | Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13,… Affected: 2016.4.0 before 2016.4.12; 2017.3.0 before 2017.3.7; 2018.1.0 before 2018.1.1 |
| CVE-2016-5716 | 8.8 | Aug 9 | The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node Affected: 2015.2.0; 2015.2.1; 2015.2.2; 2015.2.3; 2015.3.0; 2015.3.1; +6 more |
| CVE-2015-7330 | 8.8 | Apr 11 | Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol Affected: 2015.3.0 |
| CVE-2018-6508 | 8.0 | Feb 9 | Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks Affected: 2017.3.0 through 2017.3.2 |
| CVE-2023-5255 | 7.5 | Oct 3 | For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked Affected: 2023.3 |
| CVE-2020-7943 | 7.5 | Mar 11 | Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints Affected: 2018.1.0 before 2018.1.15; 2019.0 before 2019.7.0 |
| CVE-2017-2297 | 7.5 | Feb 1 | Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens Affected: before 2016.4.5; 2016.5.1; 2016.5.2; 2017.1.0; 2017.1.1 |
| CVE-2017-7529 | 7.5 | Jul 13 | Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive… Affected: before 2016.4.7; 2017.1.0 through 2017.1.1; 2017.2.1 through 2017.2.3 |
| CVE-2017-2294 | 7.5 | Jul 5 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be… Affected: through 2016.4.3; 2016.5.1; 2016.5.2; 2017.1.0; 2017.1.1 |
| CVE-2016-5714 | 7.2 | Oct 18 | Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute… Affected: 2015.3.3; 2016.1.1; 2016.1.2; 2016.2.0; 2016.2.1 |
Showing 14