Lucene search

[email protected]CVE-2023-5309

HistoryNov 07, 2023 - 7:15 p.m.

CVE-2023-5309

2023-11-0719:15:12

CWE-384

[email protected]

web.nvd.nist.gov

puppet enterprise

cve-2023-5309

security

saml

session management

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.0%

JSON

Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.

Affected configurations

NVD

Node

puppetpuppet_enterpriseRange<2021.7.6

puppetpuppet_enterpriseRange2023.0–2023.5.0

CPENameOperatorVersion
puppet:puppet_enterprisepuppet puppet enterpriselt2021.7.6
puppet:puppet_enterprisepuppet puppet enterpriselt2023.5.0

CPE	Name	Operator	Version
puppet:puppet_enterprise	puppet puppet enterprise	lt	2021.7.6
puppet:puppet_enterprise	puppet puppet enterprise	lt	2023.5.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Puppet Enterprise",
    "vendor": "Puppet",
    "versions": [
      {
        "lessThan": "2021.7.6",
        "status": "affected",
        "version": "2021.7.0",
        "versionType": "semver"
      },
      {
        "lessThan": "2023.5",
        "status": "affected",
        "version": "2023.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.puppet.com/security/cve/cve-2023-5309-broken-session-management-puppet-enterprise

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.0%

JSON

Related for CVE-2023-5309

nvd1 cvelist1 prion1