Code injection

2013-04-1015:55:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

64.8%

JSON

Puppet Labs Puppet Enterprise before 2.8.0 does not use a “randomized secret” in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.

CPENameOperatorVersion
puppet_enterpriseeq2.0.0
puppet_enterpriseeq2.5.1
puppet_enterpriseeq2.5.2
puppet_enterprisele2.7.2
puppeteq2.5.0 enterprise
puppeteq1.2.0 enterprise
puppeteq2.6.0 enterprise
puppeteq1.0.0 enterprise
puppeteq1.1.0 enterprise

Name	Operator	Version
puppet_enterprise	eq	2.0.0
puppet_enterprise	eq	2.5.1
puppet_enterprise	eq	2.5.2
puppet_enterprise	le	2.7.2
puppet	eq	2.5.0 enterprise
puppet	eq	1.2.0 enterprise
puppet	eq	2.6.0 enterprise
puppet	eq	1.0.0 enterprise
puppet	eq	1.1.0 enterprise