← Voltar para CVEs

CVE-2016-5714

HIGH

7.2

Descricao

Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."

Detalhes CVE

Pontuacao CVSS v3.17.2

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado10/18/2017

Ultima modificacao4/20/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

puppet:puppet_agentpuppet:puppet_enterprise

Fraquezas (CWE)

CWE-284

Referencias

https://bugs.gentoo.org/597684(cve@mitre.org)

https://puppet.com/security/cve/cve-2016-5714(cve@mitre.org)

https://puppet.com/security/cve/pxp-agent-oct-2016(cve@mitre.org)

https://security.gentoo.org/glsa/201710-12(cve@mitre.org)

https://bugs.gentoo.org/597684(af854a3a-2127-422b-91ae-364da2661108)

https://puppet.com/security/cve/cve-2016-5714(af854a3a-2127-422b-91ae-364da2661108)

https://puppet.com/security/cve/pxp-agent-oct-2016(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/201710-12(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.