Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.8
CVSSv3

CVE-2016-2788

Published: 13/02/2017 Updated: 24/01/2022
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Marionette Collective

Vulnerability Summary

MCollective 2.7.0 and 2.8.x prior to 2.8.9, as used in Puppet Enterprise, allows remote malicious users to execute arbitrary code via vectors related to the mco ping command.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

puppet marionette collective 2.8.3

puppet marionette collective 2.8.5

puppet marionette collective 2.8.7

puppet marionette collective 2.8.8

puppet marionette collective 2.7.0

puppet marionette collective 2.8.0

puppet marionette collective 2.8.1

puppet marionette collective 2.8.2

puppet marionette collective 2.8.4

puppet marionette collective 2.8.6

puppet puppet enterprise

Vendor Advisories

Debian CVElist Bug Report Logs: CVE-2014-3251
Debian Bug report logs - #758701 CVE-2014-3251 Package: src:mcollective; Maintainer for src:mcollective is Puppet Package Maintainers <pkg-puppet-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 20 Aug 2014 10:09:01 UTC Severity: important Tags: security Fixed in version mc ...
Debian CVElist Bug Report Logs: CVE-2016-2788
Debian Bug report logs - #850968 CVE-2016-2788 Package: src:mcollective; Maintainer for src:mcollective is Puppet Package Maintainers <pkg-puppet-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 11 Jan 2017 17:27:02 UTC Severity: grave Tags: fixed-upstream, security, upstrea ...
Debian CVElist Bug Report Logs: mcollective: CVE-2017-2292: Remote code execution via YAML deserialization
Debian Bug report logs - #866711 mcollective: CVE-2017-2292: Remote code execution via YAML deserialization Package: src:mcollective; Maintainer for src:mcollective is Puppet Package Maintainers <pkg-puppet-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 1 Jul 2017 06: ...
Red Hat: CVE-2016-2788
MCollective 270 and 28x before 289, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command ...

References

CWE-284https://puppet.com/security/cve/cve-2016-2788https://nvd.nist.govhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758701
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-29895blind SQL injectionCVE-2024-5064CVE-2023-52677CVE-2023-52682CVE-2024-30051CVE-2024-35849remote attackersremote
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook