Improper access control

2013-08-1923:55:00

PRIOn knowledge base

www.prio-n.com

7.9 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.209 Low

EPSS

Percentile

96.3%

JSON

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

CPENameOperatorVersion
ubuntu_linuxeq13.04
ubuntu_linuxeq12.10
ubuntu_linuxeq12.4 lts
suse_linux_enterprise_desktopeq11.0 sp2
suse_linux_enterprise_desktopeq11 sp3
suse_linux_enterprise_servereq11.0 sp2
suse_linux_enterprise_servereq11.0 sp3
suse_linux_enterprise_servereq11.0 sp3
puppeteq2.7.2
puppeteq2.7.10

Name	Operator	Version
ubuntu_linux	eq	13.04
ubuntu_linux	eq	12.10
ubuntu_linux	eq	12.4 lts
suse_linux_enterprise_desktop	eq	11.0 sp2
suse_linux_enterprise_desktop	eq	11 sp3
suse_linux_enterprise_server	eq	11.0 sp2
suse_linux_enterprise_server	eq	11.0 sp3
suse_linux_enterprise_server	eq	11.0 sp3
puppet	eq	2.7.2
puppet	eq	2.7.10