CVE-2021-27023

CVE-2021-27023 affects Puppet Agent and Puppet Server and is an information disclosure vulnerability where HTTP credentials can leak when following redirects to a different host. The description notes a flaw in how HTTP redirects are handled, similar to CVE-2018-1000007. The NVD metrics indicate ...

CVE-2019-10694

CVE-2019-10694 affects Puppet Enterprise where the Express install could leave an overlooked default password for the admin user if the user did not use the URL provided to set the password. The issue is resolved in Puppet Enterprise 2019.0.3 and in 2018.1.9. The public descriptions consistently ...

CVE-2013-1640

CVE-2013-1640 affects Puppet master handling of template and inline_template functions. The flaw allows remote authenticated users to execute arbitrary code via a crafted catalog request. Affected versions include Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, as well as Puppe...

CVE-2023-2530

CVE-2023-2530 is a remote code execution vulnerability in Puppet's orchestration service that enables privilege escalation. Public details across multiple sources indicate the issue affects Puppet Enterprise versions prior to 2021.0 in the 2021.x line and prior to 2023.2 in the 2023.x line (per N...

CVE-2016-2786

The CVE-2016-2786 entry affects the pxp-agent component in Puppet Enterprise 2015.3.x (before 2015.3.3) and Puppet Agent 1.3.x (before 1.3.6), where improper validation of server certificates may allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate. Thi...

CVE-2016-2788

CVE-2016-2788 affects MCollective in Puppet Enterprise (2.7.0 and 2.8.x prior to 2.8.9). The vulnerability allows a remote attacker to execute arbitrary code via vectors related to the mco ping command, due to insecure processing within the mcollective component used by Puppet Enterprise. The con...

CVE-2018-6512

CVE-2018-6512 affects Puppet Enterprise 2018.1.x prior to 2018.1.1 and razor-server/pe-razor-server prior to 1.9.0.0, enabling unsafe code execution when upgrading pe-razor-server. Connected sources confirm affected versions and components. Exploitation status is not specified in the documents. R...

CVE-2018-11749

CVE-2018-11749 affects Puppet Enterprise when startTLS with RBAC LDAP is configured; at login time, user credentials are sent in plaintext to the LDAP server. Affected PE versions: 2018.1.3, 2017.3.9, and 2016.4.14. Fixes are available in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. Seve...

CVE-2023-5309

CVE-2023-5309 affects Puppet Enterprise; versions prior to 2021.7.6 and prior to 2023.5 have a flaw that causes broken session management for SAML implementations. The underlying issue is a session-management defect in Puppet Enterprise’s SAML handling, leading to interruptions of authenticated s...