Puppet Enterprise Security Vulnerabilities and Issues — Puppet Enterprise CVE List

Lucene search

PuppetPuppet Enterprise

3 matches found

CVE•added 2019/11/29 9:15 p.m.•155 views

CVE-2015-1855

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) c...

5.9CVSS5.5AI score0.01749EPSS

CVE•added 2019/12/12 12:15 a.m.•119 views

CVE-2019-10694

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1...

9.8CVSS9.4AI score0.0042EPSS

CVE•added 2019/12/11 6:16 p.m.•45 views

CVE-2013-4968

Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cross-site scripting (XSS) attacks via unspecified vectors related to "live management."

6.1CVSS5.8AI score0.00327EPSS