Published: 06/08/2012 Updated: 10/07/2019

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

VMScore: 356

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

Puppet prior to 2.6.17 and 2.7.x prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
puppet puppet 2.6.15
puppetlabs puppet
puppet puppet 2.6.11
puppet puppet 2.6.4
puppet puppet 2.6.5
puppetlabs puppet 2.7.0
puppet puppet 2.6.0
puppet puppet 2.6.14
puppet puppet 2.6.3
puppet puppet 2.6.2
puppetlabs puppet 2.7.1
puppet puppet 2.7.2
puppet puppet 2.7.10
puppet puppet 2.7.11
puppet puppet 2.7.8
puppet puppet 2.7.9
puppet puppet 2.7.17
puppet puppet 2.6.9
puppet puppet 2.6.10
puppet puppet 2.6.7
puppet puppet 2.6.6
puppet puppet 2.7.6
puppet puppet 2.7.7
puppet puppet 2.7.14
puppet puppet 2.7.16
puppet puppet 2.6.12
puppet puppet 2.6.13
puppet puppet 2.6.1
puppet puppet 2.6.8
puppet puppet 2.7.3
puppet puppet 2.7.4
puppet puppet 2.7.5
puppet puppet 2.7.12
puppet puppet 2.7.13
puppet puppet enterprise

Several security issues were fixed in Puppet ...

Several security vulnerabilities have been found in Puppet, a centralized configuration management: CVE-2012-3864 Authenticated clients could read arbitrary files on the puppet master CVE-2012-3865 Authenticated clients could delete arbitrary files on the puppet master CVE-2012-3866 The report of the most recent Puppet run was sto ...

Directory traversal vulnerability in lib/puppet/reports/storerb in Puppet before 2617 and 27x before 2718, and Puppet Enterprise before 252, when Delete is enabled in authconf, allows remote authenticated users to delete arbitrary files on the puppet master server via a (dot dot) in a node name Puppet before 2617 and 27x before 2 ...

CWE-200 https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87 https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4 https://bugzilla.redhat.com/show_bug.cgi?id=839130 http://puppetlabs.com/security/cve/cve-2012-3864/http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html http://www.debian.org/security/2012/dsa-2511 http://www.ubuntu.com/usn/USN-1506-1 http://secunia.com/advisories/50014 http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html https://usn.ubuntu.com/1506-1/https://nvd.nist.gov

CVE-2012-3864

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect