CVEvulnerability
CVE-2012-5158
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-03-14
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-287
Description
Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors.
Affected configurations
• puppet puppet enterprise (<= 2.6.0)
• puppet puppet enterprise 2.0.0
• puppet puppet enterprise 2.5.1
• puppet puppet enterprise 2.5.2
• puppetlabs puppet 2.5.0
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://puppetlabs.com/security/cve/cve-2012-5158 Vendor Advisory
- http://puppetlabs.com/security/cve/cve-2012-5158 Vendor Advisory