CVEvulnerability

CVE-2016-2786

9.8 CRITICAL Published 2016-06-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-06-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.

Affected configurations

• puppet puppet agent 1.3.0 • puppet puppet agent 1.3.1 • puppet puppet agent 1.3.2 • puppet puppet agent 1.3.4 • puppet puppet agent 1.3.5 • puppet puppet enterprise 2015.3.0 • puppet puppet enterprise 2015.3.2

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References