CVE-2012-1986
puppet: Filebucket arbitrary file read
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.
Puppet v2.6.x anterior a v2.6.15 y v2.7.x anterior a v2.7.13, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x, y v2.5.x anterior a v2.5.1 permite a usuarios remotos autenticados con una clave autorizada SSL y ciertos permisos en el puppet maestro leer archivos arbitrarios a través de un ataque de enlaces simbólicos en relación con una petición REST manipulada para un archivo en un "filebucket".
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-04-02 CVE Reserved
- 2012-04-11 CVE Published
- 2023-04-19 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (18)
URL | Tag | Source |
---|---|---|
http://projects.puppetlabs.com/issues/13511 | X_refsource_misc | |
http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 | X_refsource_confirm | |
http://www.securityfocus.com/bid/52975 | Vdb Entry | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/74794 | Vdb Entry |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html | 2019-07-11 | |
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html | 2019-07-11 | |
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html | 2019-07-11 | |
http://puppetlabs.com/security/cve/cve-2012-1986 | 2019-07-11 | |
http://secunia.com/advisories/48743 | 2019-07-11 | |
http://secunia.com/advisories/48748 | 2019-07-11 | |
http://secunia.com/advisories/48789 | 2019-07-11 | |
http://secunia.com/advisories/49136 | 2019-07-11 | |
http://ubuntu.com/usn/usn-1419-1 | 2019-07-11 | |
http://www.debian.org/security/2012/dsa-2451 | 2019-07-11 | |
https://hermes.opensuse.org/messages/14523305 | 2019-07-11 | |
https://hermes.opensuse.org/messages/15087408 | 2019-07-11 | |
https://access.redhat.com/security/cve/CVE-2012-1986 | 2012-12-04 | |
https://bugzilla.redhat.com/show_bug.cgi?id=810069 | 2012-12-04 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.0 Search vendor "Puppet" for product "Puppet" and version "2.6.0" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.1 Search vendor "Puppet" for product "Puppet" and version "2.6.1" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.2 Search vendor "Puppet" for product "Puppet" and version "2.6.2" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.3 Search vendor "Puppet" for product "Puppet" and version "2.6.3" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.4 Search vendor "Puppet" for product "Puppet" and version "2.6.4" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.5 Search vendor "Puppet" for product "Puppet" and version "2.6.5" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.6 Search vendor "Puppet" for product "Puppet" and version "2.6.6" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.7 Search vendor "Puppet" for product "Puppet" and version "2.6.7" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.8 Search vendor "Puppet" for product "Puppet" and version "2.6.8" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.9 Search vendor "Puppet" for product "Puppet" and version "2.6.9" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.10 Search vendor "Puppet" for product "Puppet" and version "2.6.10" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.11 Search vendor "Puppet" for product "Puppet" and version "2.6.11" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.12 Search vendor "Puppet" for product "Puppet" and version "2.6.12" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.13 Search vendor "Puppet" for product "Puppet" and version "2.6.13" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.6.14 Search vendor "Puppet" for product "Puppet" and version "2.6.14" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.2 Search vendor "Puppet" for product "Puppet" and version "2.7.2" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.3 Search vendor "Puppet" for product "Puppet" and version "2.7.3" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.4 Search vendor "Puppet" for product "Puppet" and version "2.7.4" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.5 Search vendor "Puppet" for product "Puppet" and version "2.7.5" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.6 Search vendor "Puppet" for product "Puppet" and version "2.7.6" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.7 Search vendor "Puppet" for product "Puppet" and version "2.7.7" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.8 Search vendor "Puppet" for product "Puppet" and version "2.7.8" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.9 Search vendor "Puppet" for product "Puppet" and version "2.7.9" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.10 Search vendor "Puppet" for product "Puppet" and version "2.7.10" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Search vendor "Puppet" for product "Puppet" | 2.7.11 Search vendor "Puppet" for product "Puppet" and version "2.7.11" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 2.5.0 Search vendor "Puppet" for product "Puppet Enterprise" and version "2.5.0" | - |
Affected
| ||||||
Puppetlabs Search vendor "Puppetlabs" | Puppet Search vendor "Puppetlabs" for product "Puppet" | 2.7.0 Search vendor "Puppetlabs" for product "Puppet" and version "2.7.0" | - |
Affected
| ||||||
Puppetlabs Search vendor "Puppetlabs" | Puppet Search vendor "Puppetlabs" for product "Puppet" | 2.7.1 Search vendor "Puppetlabs" for product "Puppet" and version "2.7.1" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 1.2.0 Search vendor "Puppet" for product "Puppet Enterprise" and version "1.2.0" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 1.2.1 Search vendor "Puppet" for product "Puppet Enterprise" and version "1.2.1" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 1.2.2 Search vendor "Puppet" for product "Puppet Enterprise" and version "1.2.2" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 1.2.3 Search vendor "Puppet" for product "Puppet Enterprise" and version "1.2.3" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 1.2.4 Search vendor "Puppet" for product "Puppet Enterprise" and version "1.2.4" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 2.0.0 Search vendor "Puppet" for product "Puppet Enterprise" and version "2.0.0" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 2.0.1 Search vendor "Puppet" for product "Puppet Enterprise" and version "2.0.1" | - |
Affected
| ||||||
Puppet Search vendor "Puppet" | Puppet Enterprise Search vendor "Puppet" for product "Puppet Enterprise" | 2.0.2 Search vendor "Puppet" for product "Puppet Enterprise" and version "2.0.2" | - |
Affected
| ||||||
Puppetlabs Search vendor "Puppetlabs" | Puppet Enterprise Users Search vendor "Puppetlabs" for product "Puppet Enterprise Users" | 1.0 Search vendor "Puppetlabs" for product "Puppet Enterprise Users" and version "1.0" | - |
Affected
| ||||||
Puppetlabs Search vendor "Puppetlabs" | Puppet Enterprise Users Search vendor "Puppetlabs" for product "Puppet Enterprise Users" | 1.1 Search vendor "Puppetlabs" for product "Puppet Enterprise Users" and version "1.1" | - |
Affected
|