CVE-2016-2785

Description

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

References

https://security.gentoo.org/glsa/201606-02

https://puppet.com/security/cve/cve-2016-2785

https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3