CVE-2016-2785
Properties
- Published:
- 09.06.2016
- Updated:
- 15.06.2016
- Patch available:
- Severity:
- High
- CVSS vector:
- (AV:N/AC:L/Au:N/C:P/I:P/A:P)
- Product:
-
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet_server
puppetlabs: puppet
puppetlabs: puppet
puppetlabs: puppet
puppetlabs: puppet
puppetlabs: puppet
puppetlabs: puppet
Vulnerability description
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.References:
GENTOO: https://security.gentoo.org/glsa/201606-02CONFIRM: https://puppet.com/security/cve/cve-2016-2785
CONFIRM: https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2