CVE-2016-5715

🗓️ 12 Jan 2017 23:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 58 Views🌐 WEB

Open redirect vulnerability in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via // followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501

Reporter	Title	Published	Views	Family All 13
CNVD	Puppet Enterprise Open Redirect Vulnerability	26 Oct 201600:00	–	cnvd
Cvelist	CVE-2016-5715	12 Jan 201723:00	–	cvelist
Debian CVE	CVE-2016-5715	12 Jan 201723:00	–	debiancve
EUVD	EUVD-2016-6654	7 Oct 202500:30	–	euvd
NVD	CVE-2016-5715	12 Jan 201723:59	–	nvd
OpenVAS	Puppet Enterprise < 2016.4.0 Multiple Vulnerabilities	1 Nov 201600:00	–	openvas
OSV	CVE-2016-5715	12 Jan 201723:59	–	osv
Packet Storm	Puppet Enterprise Web Interface Open Redirect	22 Oct 201600:00	–	packetstorm
Prion	Open redirect	12 Jan 201723:59	–	prion
Positive Technologies	PT-2017-1213	12 Jan 201700:00	–	ptsecurity

NVD

Node

puppet puppet_enterpriseRange2015.2.0–2015.3.3

puppet puppet_enterpriseRange2016.1.1–2016.4.0

Source	Link
securityfocus	www.securityfocus.com/archive/1/539618/100/0/threaded
packetstormsecurity	www.packetstormsecurity.com/files/139302/Puppet-Enterprise-Web-Interface-Open-Redirect.html
hyp3rlinx	www.hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txt
securityfocus	www.securityfocus.com/bid/93846
puppet	www.puppet.com/security/cve/cve-2016-5715

Parameter	Position	Path	Description	CWE
redirect	query param	auth/login	Open redirect via redirect parameter allowing attacker-controlled redirect URL with double slash payload	CWE-601

13 May 2026 00:24Current

6.3Medium risk

Vulners AI Score6.3

CVSS 25.8

CVSS 36.1

EPSS0.0069

CWE-601