CVE-2016-2785

Published: Jun 10, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

Affected (22)

Products: Puppet: Puppet, Puppet Server, Puppet Agent

3 products

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet	Version 4.0.0
Puppet Puppet	Version 4.0.0 rc1
Puppet Puppet	Version 4.0.0 rc2
Puppet Puppet	Version 4.0.0 rc3
Puppet Puppet	Version 4.1.0
Puppet Puppet	Version 4.2.0
Puppet Puppet	Version 4.2.1
Puppet Puppet	Version 4.2.2
Puppet Puppet	Version 4.2.3
Puppet Puppet	Version 4.3.0
Puppet Puppet	Version 4.3.1
Puppet Puppet	Version 4.3.2
Puppet Puppet	Version 4.4.0
Puppet Puppet	Version 4.4.1

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet Server	Version 2.0.0
Puppet Puppet Server	Version 2.1.0
Puppet Puppet Server	Version 2.1.1
Puppet Puppet Server	Version 2.1.2
Puppet Puppet Server	Version 2.2.0
Puppet Puppet Server	Version 2.3.0
Puppet Puppet Server	Version 2.3.1