CVE-2022-0675 Puppet Firewall Module May Leave Unmanaged Rules

2022-03-0221:00:59

CWE-1289

puppet

www.cve.org

5.6 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.

CNA Affected

[
  {
    "product": "Firewall Module",
    "vendor": "Puppet",
    "versions": [
      {
        "lessThan": "3.4.0",
        "status": "affected",
        "version": "prior to 3.4.0",
        "versionType": "custom"
      }
    ]
  }
]