Ubuntu.comUB:CVE-2016-5714CVE-2016-5714
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.007 Low
EPSS
Percentile
79.8%
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent
1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist
protection mechanism and execute arbitrary code on Puppet nodes via vectors
related to command validation, aka “Puppet Execution Protocol (PXP) Command
Whitelist Validation Vulnerability.”
Notes
| Author | Note |
|---|---|
| ratliff | Upstream says “Default configurations of FOSS Puppet Agent are not vulnerable.” |
Related
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
0.007 Low
EPSS
Percentile
79.8%