CVE-2011-0528

Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.

CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.mail-archive.com/puppet-users%40googlegroups.com/msg16429.html
http://www.openwall.com/lists/oss-security/2011/01/27/6
http://www.openwall.com/lists/oss-security/2011/01/31/5
http://www.ubuntu.com/usn/USN-1365-1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:puppet:puppet:2.6.0:::::::*
	cpe:2.3:a:puppet:puppet:2.6.1:::::::*
	cpe:2.3:a:puppet:puppet:2.6.2:::::::*
	cpe:2.3:a:puppet:puppet:2.6.3:::::::*

History

No history.

Information

Published : 2014-02-17 16:55

Updated : 2023-12-10 11:31

NVD link : CVE-2011-0528

Mitre link : CVE-2011-0528

CVE.ORG link : CVE-2011-0528

JSON object : View

Products Affected

puppet

puppet

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2011-0528", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-02-17T16:55:04.787", "references": [{"url": "http://www.mail-archive.com/puppet-users%40googlegroups.com/msg16429.html", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2011/01/27/6", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2011/01/31/5", "source": "secalert@redhat.com"}, {"url": "http://www.ubuntu.com/usn/USN-1365-1", "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors."}, {"lang": "es", "value": "Puppet 2.6.0 hasta 2.6.3 no restringe debidamente el acceso a los recursos de nodo, lo que permite a nodos Puppet remotos autenticados leer o modificar los recursos de otros nodos a trav\u00e9s de vectores no especificados."}], "lastModified": "2019-07-10T14:13:09.043", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}