CVE-2016-2786

published 2016-06-10

CVE-2016-2786: The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which…

Priority P3 49 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	puppet	—	—
puppet	puppet_agent	—	—
puppet	puppet_agent	—	—
puppet	puppet_agent	—	—
puppet	puppet_agent	—	—
puppet	puppet_agent	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_debian 9.8 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20