Puppet vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-2530 A privilege escalation allowing remote code execution was discovered in the orchestration service.Critical 9.8 · Jun 7, 2023
• CVE-2022-3276 Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0.High 8.4 · Oct 7, 2022
• CVE-2022-3275 Command injection is possible in the puppetlabs-apt module prior to version 9.0.0.High 8.4 · Oct 7, 2022
• CVE-2021-27024 A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet EnterpriseHigh 8.1 · Nov 18, 2021
• CVE-2021-27023 A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host.Critical 9.8 · Nov 18, 2021
• CVE-2021-27020 Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.High 8.8 · Aug 30, 2021
• CVE-2021-27018 The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to nHigh 7.5 · Aug 30, 2021
• CVE-2021-27021 A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.High 8.8 · Jul 20, 2021
• CVE-2020-7944 In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive pHigh 7.7 · Mar 26, 2020
• CVE-2020-7943 Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints.High 7.5 · Mar 11, 2020
• CVE-2015-5686 Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks.High 8.8 · Feb 26, 2020
• CVE-2019-10694 The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password.Critical 9.8 · Dec 11, 2019
• CVE-2018-6517 Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file withouHigh 7.5 · Mar 21, 2019
• CVE-2018-11747 Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container.Critical 9.8 · Mar 21, 2019
• CVE-2018-11748 Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable.High 7.8 · Oct 2, 2018
• CVE-2018-11749 When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server.Critical 9.8 · Aug 24, 2018
• CVE-2018-11746 In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if High 8.6 · Jul 3, 2018
• CVE-2018-6516 On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.High 7.8 · Jun 14, 2018
• CVE-2018-6515 Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuHigh 7.8 · Jun 11, 2018
• CVE-2018-6514 In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloadiHigh 7.8 · Jun 11, 2018
• CVE-2018-6513 Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x pHigh 8.8 · Jun 11, 2018
• CVE-2018-6512 The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server.Critical 9.8 · Jun 11, 2018
• CVE-2018-6508 Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_High 8 · Feb 9, 2018
• CVE-2017-2297 Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens.High 7.5 · Feb 1, 2018
• CVE-2015-7224 puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysCritical 9.8 · Dec 21, 2017