CVE-2013-4962

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors...

CVE-2013-4959

Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow local users to obtain sensitive information such as 1 host name, 2 MAC address, and 3 SSH keys via the web browser cache...

SUSE CVE-2023-5309

Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations...

Puppet Enterprise Administration Module 安全漏洞

Puppet Enterprise Administration Module PEADM is an open source Puppet module from Puppet that defines the Bolt program. It is used to automate Puppet Enterprise deployments. A security vulnerability exists in Puppet Enterprise Administration Module versions prior to 3.24.0 that stems from the...

CVE-2023-5309

Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations...

CVE-2023-5309

Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations...

CVE-2023-5309

CVE-2023-5309 affects Puppet Enterprise; versions prior to 2021.7.6 and prior to 2023.5 have a flaw that causes broken session management for SAML implementations. The underlying issue is a session-management defect in Puppet Enterprise’s SAML handling, leading to interruptions of authenticated s...

CVE-2023-5309 Broken Session Management in Puppet Enterprise

Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations...

PT-2023-32029 · Puppet · Puppet Enterprise

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions prior to 2021.7.6 Puppet Enterprise versions prior to 2023.5 Description: The issue results in broken session management for SAML implementations. Recommendations: For versions prior to 2021.7.6, update to version...

Puppet Enterprise Authorization Issues Vulnerability

Puppet is a set of configuration management tools based on a client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage profiles, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. An authorization issue vulnerabilit...

Puppet Enterprise < 2019.8.6 Information Disclosure

PuppetDB logging included potentially sensitive system information. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugin were extracted from the...

Puppet Enterprise 2021.7.1 / 2023.0 DoS

A Regular Expression Denial of Service ReDoS issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations. Note that Nessus has not tested for this issue but has instead relied only on t...

Puppet Enterprise < 2019.8.7 / 2021.x < 2021.2 SQLi

A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows a user with read access to PuppetDB to delete tables via an SQL query. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

Puppet Enterprise < 2019.8.7 / 2021.x < 2021.2 Nginx Vulnerability

or more information about this vulnerability, refer to the security announcements for CVE-2021-23017 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugi...

Puppet Enterprise < 2019.8.9 / 2021.x < 2021.4.0 Information Disclosure

A flaw was discovered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive tex...

Puppet Enterprise < 2019.8.9 / 2021.x < 2021.4.0 DoS

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first pluginsync. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

Puppet Enterprise 2021.x < 2021.0 / 2023.x < 2023.2 RCE

A privilege escalation allowing remote code execution was discovered in the orchestration service. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugin...

Puppet Enterprise < 2019.8.6 PostgreSQL Vulnerabilities

For more information about these vulnerabilities, refer to the Postgresql News Page. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugin were extracted...

Puppet Enterprise < 2019.8.6 / 2021.1.0 Multiple OpenSSL Vulnerabilities

The openssl software which exists in puppet enterprise prior to 2019.8.6 has multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this...

Puppet Enterprise < 2019.8.8 / 2021.3.0 Information Disclosure Vulnerability

A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes inventory service nodes. Note that Nessus has not tested for this issue but has instead...