Puppet Enterprise (PE) prior to 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
puppet puppet enterprise 2.0.0 |
||
puppet puppet enterprise |
||
puppet puppet enterprise 2.5.2 |
||
puppet puppet enterprise 2.5.1 |
||
puppetlabs puppet 2.5.0 |