CVE-2016-2785

Опубликовано: 10 июн. 2016

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

Ссылки

https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2
Vendor Advisory
https://puppet.com/security/cve/cve-2016-2785
Vendor Advisory
https://security.gentoo.org/glsa/201606-02
Third Party Advisory
https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2
Vendor Advisory
https://puppet.com/security/cve/cve-2016-2785
Vendor Advisory
https://security.gentoo.org/glsa/201606-02
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:puppet:puppet:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.0.0:rc3:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.1.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.3.1:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.3.2:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:4.4.1:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:puppet:puppet_server:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_server:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_server:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_server:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_server:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_server:2.3.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_server:2.3.1:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:puppet:puppet_agent:1.4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 38%

0.0017

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-284

Связанные уязвимости

CVE-2016-2785

CVSS3: 9.8

ubuntu

больше 9 лет назад

CVE-2016-2785

redhat

почти 10 лет назад

CVE-2016-2785

CVSS3: 9.8

debian

больше 9 лет назад

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before ...

GHSA-pqj5-7r86-64fv

CVSS3: 9.8

github

больше 3 лет назад

Puppet Improper Access Control

EPSS

Процентиль: 38%

0.0017

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-284