CVSS: 7.5EPSS: 7%CPEs: 6EXPL: 0CVE-2020-7943 – puppet: puppet server and puppetDB may leak sensitive information via metrics API
https://notcve.org/view.php?id=CVE-2020-7943
Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. • https://puppet.com/security/cve/CVE-2020-7943 https://access.redhat.com/security/cve/CVE-2020-7943 https://bugzilla.redhat.com/show_bug.cgi?id=1828486 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5686
https://notcve.org/view.php?id=CVE-2015-5686
Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session. Se encontró que partes de la Puppet Enterprise Console versiones 3.x, eran susceptibles a ataques de secuestro de cliqueo y de tipo CSRF (Cross-Site Request Forgery). Esto permitiría a un atacante redireccionar la entrada del usuario hacia un sitio no confiable o secuestrar una sesión de usuario. • https://puppet.com/security/cve/CVE-2015-5686 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-7942 – puppet: Arbitrary catalog retrieval
https://notcve.org/view.php?id=CVE-2020-7942
Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. • https://puppet.com/security/cve/CVE-2020-7942 https://access.redhat.com/security/cve/CVE-2020-7942 https://bugzilla.redhat.com/show_bug.cgi?id=1816720 • CWE-295: Improper Certificate Validation CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-11751 – puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL
https://notcve.org/view.php?id=CVE-2018-11751
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. Las versiones anteriores de Puppet Agent no comprobaban el peer en la conexión SSL antes de descargar la CRL. Este problema es resuelto en Puppet Agent versión 6.4.0. A flaw was found in Puppet, where the Puppet Agent did not verify the peer in the SSL connection before downloading to the Certificate Revocation List (CRL). • https://puppet.com/security/cve/CVE-2018-11751 https://access.redhat.com/security/cve/CVE-2018-11751 https://bugzilla.redhat.com/show_bug.cgi?id=1788261 • CWE-295: Improper Certificate Validation CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-0175
https://notcve.org/view.php?id=CVE-2014-0175
mcollective has a default password set at install mcollective presenta una contraseña predeterminada establecida en la instalación. • https://access.redhat.com/security/cve/cve-2014-0175 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0175 https://security-tracker.debian.org/tracker/CVE-2014-0175 • CWE-798: Use of Hard-coded Credentials •