Product:

Puppet_enterprise

(Puppet)
Repositories https://github.com/puppetlabs/puppet
#Vulnerabilities 87
Date Id Summary Products Score Patch Annotated
2019-12-12 CVE-2019-10694 The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9. Puppet_enterprise 9.8
2020-03-11 CVE-2020-7943 Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1... Puppet_enterprise, Puppet_server, Puppetdb 7.5
2021-07-20 CVE-2021-27021 A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query. Puppet, Puppet_enterprise, Puppetdb 8.8
2021-11-18 CVE-2021-27026 A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged Puppet, Puppet_connect, Puppet_enterprise 4.4
2021-08-30 CVE-2021-27019 PuppetDB logging included potentially sensitive system information. Puppet_enterprise, Puppetdb 4.3
2021-08-30 CVE-2021-27020 Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. Puppet_enterprise 8.8
2020-02-27 CVE-2015-5686 Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session. Puppet_enterprise N/A
2019-11-29 CVE-2015-1855 verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters. Debian_linux, Puppet_agent, Puppet_enterprise, Ruby, Trunk N/A
2019-12-11 CVE-2013-4968 Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cross-site scripting (XSS) attacks via unspecified vectors related to "live management." Puppet_enterprise N/A
2018-02-09 CVE-2017-10689 In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability. Ubuntu_linux, Puppet, Puppet_enterprise, Satellite 5.5