Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

puppet puppet enterprise 2.5.0 vulnerabilities and exploits

(subscribe to this query)
4
CVSSv2
CVE-2012-5158
Puppet Enterprise (PE) prior to 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors.
Puppet Puppet Enterprise 2.0.0Puppet Puppet EnterprisePuppet Puppet Enterprise 2.5.2Puppet Puppet Enterprise 2.5.1Puppetlabs Puppet 2.5.0
8.5
CVSSv2
CVE-2013-1398
The pe_mcollective module in Puppet Enterprise (PE) prior to 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the m...
Puppet Puppet Enterprise 2.5.1Puppetlabs Puppet 2.5.0Puppet Puppet Enterprise 2.0.0Puppet Puppet EnterprisePuppet Puppet Enterprise 2.5.2Puppetlabs Puppet 2.6.0
6.8
CVSSv2
CVE-2013-1399
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) prior to 2.7.1 allow remote malicious users to hijack the authentication of unspecif...
Puppetlabs Puppet 2.6.0Puppet Puppet Enterprise 2.5.2Puppet Puppet Enterprise 2.5.1Puppetlabs Puppet 2.5.0Puppet Puppet Enterprise 2.0.0Puppet Puppet Enterprise
5
CVSSv2
CVE-2013-2716
Puppet Labs Puppet Enterprise prior to 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote malicious users to obtain console access via a crafted cookie.
Puppet Puppet Enterprise 2.5.2Puppetlabs Puppet 2.6.0Puppet Puppet Enterprise 2.5.1Puppetlabs Puppet 2.5.0Puppet Puppet EnterprisePuppetlabs Puppet 1.1.0Puppetlabs Puppet 1.0.0Puppet Puppet Enterprise 2.0.0Puppetlabs Puppet 1.2.0
3.6
CVSSv2
CVE-2012-1989
telnet.rb in Puppet 2.7.x prior to 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
Puppet Puppet 2.7.8Puppet Puppet 2.7.6Puppet Puppet 2.7.11Puppet Puppet 2.7.9Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.12Puppet Puppet 2.7.4Puppet Puppet 2.7.3Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.10Puppet Puppet 2.7.5Puppet Puppet Enterprise 1.2.1Puppet Puppet Enterprise 1.2.4Puppet Puppet Enterprise 2.0.1Puppet Puppet Enterprise 2.5.0Puppet Puppet Enterprise 2.0.0Puppet Puppet Enterprise 2.0.2Puppet Puppet Enterprise 1.2.2Puppet Puppet Enterprise 1.2.0Puppet Puppet Enterprise 1.2.3
3.3
CVSSv2
CVE-2012-1906
Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or i...
Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.6.13Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.3Puppet Puppet 2.7.11Puppet Puppet 2.7.7Puppet Puppet 2.7.6Puppet Puppet 2.7.5
2.1
CVSSv2
CVE-2012-1986
Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlin...
Puppet Puppet 2.6.13Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.4Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.3Puppet Puppet 2.7.11
3.5
CVSSv2
CVE-2012-1987
Unspecified vulnerability in Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a...
Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.13Puppet Puppet 2.6.12Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.6.11Puppet Puppet 2.6.10Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.1Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.4Puppet Puppet 2.7.3
7.5
CVSSv2
CVE-2013-3567
Puppet 2.7.x prior to 2.7.22 and 3.2.x prior to 3.2.2, and Puppet Enterprise prior to 2.8.2, deserializes untrusted YAML, which allows remote malicious users to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.10Puppet Puppet 2.7.18Puppetlabs Puppet 2.7.19Puppetlabs Puppet 3.2.0Puppet Puppet 2.7.13Puppet Puppet 2.7.14Puppetlabs Puppet 2.7.20Puppet Puppet 2.7.21Puppet Puppet 2.7.11Puppet Puppet 2.7.12Puppet Puppet 2.7.2Puppet Puppet 3.2.1Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.16Puppet Puppet 2.7.17Canonical Ubuntu Linux 12.10Canonical Ubuntu Linux 12.04Canonical Ubuntu Linux 13.04Novell Suse Linux Enterprise Server 11.0Novell Suse Linux Enterprise Desktop 11.0Novell Suse Linux Enterprise Desktop 11
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322cross-site request forgeryunauthorizedCVE-2024-33925reflected XSSCVE-2023-51580CVE-2023-51579CVE-2015-2051CVE-2023-51609
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook