Puppet Improper Access Control
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-2785US | critical9.8 | — | ||
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restri… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/puppetlabs/puppetPACKAGE
- https://github.com/puppetlabs/puppet/commit/6592a8166572e5f1b7d058474059b8519ec81387WEB
- https://github.com/puppetlabs/puppet/commits/4.4.2WEB
- https://nvd.nist.gov/vuln/detail/CVE-2016-2785ADVISORY
- https://puppet.com/security/cve/cve-2016-2785WEB
- https://security.gentoo.org/glsa/201606-02WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan