// For flags

CVE-2020-7943

puppet: puppet server and puppetDB may leak sensitive information via metrics API

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

Puppet Server y PuppetDB proporcionan información útil de rendimiento y depuración a través de sus puntos finales API de métricas. Para PuppetDB esto puede contener cosas como nombres de host. Puppet Server informa los nombres y títulos de los recursos para los tipos definidos (que pueden contener información confidencial), así como los nombres de las funciones y los nombres de las clases. Anteriormente, estos puntos finales estaban abiertos a la red local. PE 2018.1.13 y 2019.5.0, Puppet Server 6.9.2 y 5.3.12 y PuppetDB 6.9.1 y 5.2.13 deshabilitan la API de métricas trapperkeeper-metrics / v1 y solo permiten el acceso / v2 en localhost de forma predeterminada. Esto afecta a las versiones de software: transmisión de Puppet Enterprise 2018.1.x anterior a 2018.1.13 Puppet Enterprise anterior a 2019.5.0 Puppet Server anterior a 6.9.2 Puppet Server anterior a 5.3.12 PuppetDB anterior a 6.9.1 PuppetDB anterior a 5.2.13 resuelto en: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

A flaw was found where the metrics API endpoints of Puppet Server and PuppetDB leaked sensitive information to the local network. Listening to these network endpoints could allow attackers the ability to exploit additional computer systems. The highest impact of this flaw is confidentiality.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-23 CVE Reserved
  • 2020-03-11 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-10-25 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-276: Incorrect Default Permissions
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Puppet
Search vendor "Puppet"
 Puppet Enterprise
Search vendor "Puppet" for product "Puppet Enterprise"
 >= 2018.1.0 < 2018.1.15
Search vendor "Puppet" for product "Puppet Enterprise" and version " >= 2018.1.0 < 2018.1.15"
-
Affected
Puppet
Search vendor "Puppet"
 Puppet Enterprise
Search vendor "Puppet" for product "Puppet Enterprise"
 >= 2019.0 < 2019.7.0
Search vendor "Puppet" for product "Puppet Enterprise" and version " >= 2019.0 < 2019.7.0"
-
Affected
Puppet
Search vendor "Puppet"
 Puppet Server
Search vendor "Puppet" for product "Puppet Server"
 < 5.3.13
Search vendor "Puppet" for product "Puppet Server" and version " < 5.3.13"
-
Affected
Puppet
Search vendor "Puppet"
 Puppet Server
Search vendor "Puppet" for product "Puppet Server"
 >= 6.0.0 < 6.11.1
Search vendor "Puppet" for product "Puppet Server" and version " >= 6.0.0 < 6.11.1"
-
Affected
Puppet
Search vendor "Puppet"
 Puppetdb
Search vendor "Puppet" for product "Puppetdb"
 < 5.2.15
Search vendor "Puppet" for product "Puppetdb" and version " < 5.2.15"
-
Affected
Puppet
Search vendor "Puppet"
 Puppetdb
Search vendor "Puppet" for product "Puppetdb"
 >= 6.0.0 < 6.10.1
Search vendor "Puppet" for product "Puppetdb" and version " >= 6.0.0 < 6.10.1"
-
Affected