CVE-2016-5715
published 2017-01-12CVE-2016-5715: Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web…
PriorityP426medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.46%
71.8th percentile
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | puppet | — | — |
| puppet | puppet_enterprise | 2015.2.0 – 2015.3.3 | — |
| puppet | puppet_enterprise | 2016.1.1 – 2016.4.0 | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_debian6.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2016-5715: puppet - Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016....
vendor_debian·2016·CVSS 6.1
CVE-2016-5715 [MEDIUM] CVE-2016-5715: puppet - Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016....
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501.
Scope: local
bullseye: resolved
VulDB
Puppet Enterprise up to 2016.3 Web Interface redirect (Nessus ID 95392 / BID-93846)
vuldb·2026-05-13
CVE-2016-5715 [CRITICAL] Puppet Enterprise up to 2016.3 Web Interface redirect (Nessus ID 95392 / BID-93846)
A vulnerability categorized as critical has been discovered in Puppet Enterprise up to 2016.3. Affected by this vulnerability is an unknown functionality of the component Web Interface. Such manipulation leads to open redirect.
This vulnerability is listed as CVE-2016-5715. The attack may be performed from remote. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
GHSA-vgm7-rcgw-qc8p: Open redirect vulnerability in the Console in Puppet Enterprise 2015
ghsa_unreviewed·2022-05-13·CVSS 6.1
CVE-2016-5715 [MEDIUM] CWE-601 GHSA-vgm7-rcgw-qc8p: Open redirect vulnerability in the Console in Puppet Enterprise 2015
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txthttp://packetstormsecurity.com/files/139302/Puppet-Enterprise-Web-Interface-Open-Redirect.htmlhttp://www.securityfocus.com/archive/1/539618/100/0/threadedhttp://www.securityfocus.com/bid/93846https://puppet.com/security/cve/cve-2016-5715http://hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txthttp://packetstormsecurity.com/files/139302/Puppet-Enterprise-Web-Interface-Open-Redirect.htmlhttp://www.securityfocus.com/archive/1/539618/100/0/threadedhttp://www.securityfocus.com/bid/93846https://puppet.com/security/cve/cve-2016-5715
2017-01-12
Published