CVE-2015-7328

Published: Jan 8, 2016Modified: May 6, 2026

4.7

Vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.0 / Impact: 3.6

Source: NVD

Description

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors.

Affected (6)

Products: Puppet: Puppet Enterprise

Puppet

1 product

Puppet Enterprise

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet Enterprise	Version 2015.2.0
Puppet Puppet Enterprise	Version 2015.2.1
Puppet Puppet Enterprise	Version 2015.2.2
Puppet Puppet Enterprise	Version 3.8.0
Puppet Puppet Enterprise	Version 3.8.1
Puppet Puppet Enterprise	Version 3.8.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://puppetlabs.com/security/cve/cve-2015-7328

Source: cve@mitre.org

Vendor Advisory

https://puppetlabs.com/security/cve/cve-2015-7328

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.