Vulnetix
Try Vulnetix Request Demo
CVE-2014-3251 PUBLISHED CVSS 4.400000095367432 MEDIUM

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

EPSS 0.03% · 7.3th percentile

Risk Scores

CVSS v2.0
4.400000095367432
EPSS Score
0.03%
7.3th percentile

Affected Products

VendorProductVersions
puppetlabsmcollective
n/an/an/a
puppetpuppet_enterprise0

Timeline

References

Open in Interactive Console →