9.8

CVE-2016-2785

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Puppet ≫ Puppet Version4.0.0
Puppet ≫ Puppet Version4.0.0 Updaterc1
Puppet ≫ Puppet Version4.0.0 Updaterc2
Puppet ≫ Puppet Version4.0.0 Updaterc3
Puppet ≫ Puppet Version4.1.0
Puppet ≫ Puppet Version4.2.0
Puppet ≫ Puppet Version4.2.1
Puppet ≫ Puppet Version4.2.2
Puppet ≫ Puppet Version4.2.3
Puppet ≫ Puppet Version4.3.0
Puppet ≫ Puppet Version4.3.1
Puppet ≫ Puppet Version4.3.2
Puppet ≫ Puppet Version4.4.0
Puppet ≫ Puppet Version4.4.1
Puppet ≫ Puppet Server Version2.0.0
Puppet ≫ Puppet Server Version2.1.0
Puppet ≫ Puppet Server Version2.1.1
Puppet ≫ Puppet Server Version2.1.2
Puppet ≫ Puppet Server Version2.2.0
Puppet ≫ Puppet Server Version2.3.0
Puppet ≫ Puppet Server Version2.3.1
Puppet ≫ Puppet Agent Version1.4.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.386
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.