Puppet Puppet Enterprise vulnerabilities

CVEs per yearBy the year they were published

1. 20172
2. 20184
3. 20186
4. 20234

Newest CVEs

• CVE-2023-5309

  Broken Session Management in Puppet Enterprise

  Puppet · Puppet Enterprise

  Medium6.8
• CVE-2023-5255

  Denial of Service for Revocation of Auto Renewed Certificates

  Puppet · Puppet Enterprise

  Medium4.4
• CVE-2023-2530

  A privilege escalation allowing remote code execution was discovered in the orchestration service.

  Puppet · Puppet Enterprise

  Critical9.8
• CVE-2023-1894

  A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted…

  Puppet · Puppet Enterprise

  Medium5.3
• CVE-2018-11749

  When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet…

  Puppet · Puppet Enterprise

  Critical9.8
• CVE-2018-6511

  XSS Vulnerability in Puppet Enterprise Console

  Puppet · Puppet Enterprise

  Medium5.4
• CVE-2018-6510

  XSS Vulnerability in Puppet Enterprise Console

  Puppet · Puppet Enterprise

  Medium5.4
• CVE-2018-6508

  Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or…

  Puppet · Puppet Enterprise

  High8.0
• CVE-2017-10690

  In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was…

  Puppet · Puppet Enterprise

  Medium6.5
• CVE-2017-10689

  In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this…

  Puppet · Puppet Enterprise

  Medium5.5