CVE-2016-2785 | Vulnetix

CVE-2016-2785 PUBLISHED CVSS 9.800000190734863 CRITICAL

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

EPSS 2.89% · 86.8th percentile

Risk Scores

CVSS 3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

2.89%

86.8th percentile

Affected Products

Vendor	Product	Versions
puppet	puppet_agent	1.4.1
puppet	puppet_server	2.0.0, 2.1.0, 2.1.1
n/a	n/a	n/a
puppet	puppet	4.3.2, 4.4.1, 4.0.0
RubyGems	puppet	4.0.0

Timeline

Jun 10, 2016 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 13, 2022 EPSS Score
Sep 5, 2022 EPSS Score
Dec 20, 2022 EPSS Score
Feb 11, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 5, 2023 EPSS Score
May 28, 2023 EPSS Score
Jul 20, 2023 EPSS Score

References

https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2 url
https://puppet.com/security/cve/cve-2016-2785 url
GLSA-201606-02 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-2785 advisory
https://github.com/puppetlabs/puppet/commit/6592a8166572e5f1b7d058474059b8519ec81387 url
https://github.com/puppetlabs/puppet package
https://github.com/puppetlabs/puppet/commits/4.4.2 url

Open in Interactive Console →