7.5
CVE-2017-2297
- EPSS 0.3%
- Veröffentlicht 01.02.2018 22:29:00
- Zuletzt bearbeitet 21.11.2024 03:23:14
- Quelle security@puppet.com
- Teams Watchlist Login
- Unerledigt Login
Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5 and 2017.2.1. This only affects users with labeled tokens, which is not the default for tokens.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Puppet ≫ Puppet Enterprise Version < 2016.4.5
Puppet ≫ Puppet Enterprise Version2016.5.1
Puppet ≫ Puppet Enterprise Version2016.5.2
Puppet ≫ Puppet Enterprise Version2017.1.0
Puppet ≫ Puppet Enterprise Version2017.1.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.3% | 0.53 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 1.6 | 5.9 |
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6 | 6.8 | 6.4 |
AV:N/AC:M/Au:S/C:P/I:P/A:P
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.