CVE-2015-4100
Published: 21 December 2017
Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master, aka a "Certificate Authority Reverse Proxy Vulnerability."
Notes
| Author | Note |
|---|---|
| ratliff | Upstream says "Default 'monolithic', 'split', and multimaster installs of PE 3.7.x or PE 3.8.0 are not affected. The vulnerability is resolved by default in Puppet Enterprise 3.8.1." |
Priority
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.8 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H |