CVE-2022-0675

Published: Mar 2, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.

Affected (1)

Products: Puppet: Firewall

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Puppet Firewall	Before 3.4.0

Related CWEs

Improper Validation of Unsafe Equivalence in Input

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://puppet.com/security/cve/CVE-2022-0675

Source: security@puppet.com

Vendor Advisory

https://puppet.com/security/cve/CVE-2022-0675

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.