Lucene search

PuppetCVE-2019-10695

HistoryDec 12, 2019 - 12:15 a.m.

CVE-2019-10695

2019-12-1200:15:11

CWE-532

puppet

web.nvd.nist.gov

103

cve-2019-10695

security

cd4pe

continuous delivery

pe console

puppetlabs/cd4pe module

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the job’s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the puppetlabs/cd4pe module.

Affected configurations

Nvd

Node

puppetcontinuous_deliveryRange<1.2.1puppet_enterprise

VendorProductVersionCPE
puppetcontinuous_delivery*cpe:2.3:a:puppet:continuous_delivery:*:*:*:*:*:puppet_enterprise:*:*

Vendor	Product	Version	CPE
puppet	continuous_delivery	*	cpe:2.3:a:puppet:continuous_delivery::::::puppet_enterprise::*

CNA Affected

[
  {
    "product": "Continuous Delivery for Puppet Enterprise (CD4PE)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "puppetlabs/cd4pe module prior to 1.2.1"
      }
    ]
  }
]

References

puppet.com/security/cve/CVE-2019-10695

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Related for CVE-2019-10695