CVE-2014-3248

CVE-2014-3248 documents an untrusted search path vulnerability affecting Puppet-related components. Affected software includes Puppet Enterprise 2.8 (before 2.8.7), Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, runn...

CVE-2013-4969

CVE-2013-4969 affects Puppet before 3.3.3 and 3.4 before 3.4.1, and Puppet Enterprise before 2.8.4 and 3.1 before 3.1.1, allowing local users to overwrite arbitrary files via a symlink attack. Connected advisories indicate fixes with Puppet packages updated to 2.7.25 (e.g., Mageia MDVSA-2014:040 ...

CVE-2013-4971

CVE-2013-4971 affects Puppet Enterprise before 3.2.0. The vulnerability is an information disclosure caused by improper restriction of access to node endpoints in the console, enabling remote attackers to obtain sensitive data via unspecified vectors. The connected Nessus entry notes this CVE alo...

CVE-2012-5158

Puppet Enterprise 2.x prior to 2.6.1 is affected by a session-handling weakness: when the session secret changes, sessions are not properly invalidated, allowing an authenticated remote user to retain access via unspecified vectors. Affected component is the PE 2.x session management; root cause ...

CVE-2014-3251

CVE-2014-3251 affects the MCollective aes_security plugin used with Puppet Enterprise before 3.3.0 and MCollective before 2.5.3. The issue is improper validation of new server certificates based on the CA certificate, allowing a local attacker to establish unauthorized MCollective connections via...

CVE-2013-1398

CVE-2013-1398 concerns the pe_mcollective module in Puppet Enterprise (PE) prior to version 2.7.1. The issue is that access to a catalog of private SSL keys is not properly restricted, allowing remote authenticated users to obtain sensitive information and potentially gain privileges by leveragin...

CVE-2012-0891

CVE-2012-0891 involves multiple XSS vulnerabilities in Puppet Dashboard 1.0 up to 1.2.5 and Puppet Enterprise 1.0 up to 1.2.5, and in 2.x up to 2.0.1. The issue allows an attacker to inject arbitrary web script or HTML via unspecified input fields, enabling likely browser-side code execution and ...

CVE-2013-4966

Puppet Enterprise before 3.2.0 is affected: the master external node classification script does not verify the identity of consoles, which allows remote attackers to spoof a console and create arbitrary classifications on the master. Affected: Puppet Enterprise 3.x prior to 3.2.0. Root cause: mis...

CVE-2014-3249

CVE-2014-3249 affects Puppet Enterprise 2.8.x before 2.8.7. The vulnerability is an information-disclosure issue allowing remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes. The NVD entry documents a MEDIUM severity (CVSS2 base score 5.0) with network...

CVE-2013-1399

CVE-2013-1399 affects Puppet Enterprise before 2.7.1, with CSRF vulnerabilities in the console’s node request management, live management, and user administration components. The flaws may allow remote attackers to hijack authentication of unspecified victims via unknown vectors. The NVD describe...

CVE-2013-4963

Puppet Enterprise before 3.0.1 is affected by multiple CSRF vulnerabilities that allow an attacker to hijack user authentication for actions such as deleting a report, group, or class. The CVE-2013-4963 entry documents these issues, with the underlying impact being that an attacker could manipula...

CVE-2014-9355

Puppet Enterprise before 3.7.1 is affected. An authenticated remote user can obtain licensing and certificate signing request information by accessing an unspecified API endpoint. The affected component is Puppet Enterprise (pre-3.7.1) and the root cause is an information-disclosure path exposed ...