CVE-2017-2297: Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been…

PriorityP339high7.5CVSS 3.0

AVNACHPRLUINSUCHIHAH

EPSS

0.64%

48.0th percentile

Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5 and 2017.2.1. This only affects users with labeled tokens, which is not the default for tokens.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	puppet	—	—
puppet	puppet_enterprise	< 2016.4.5	2016.4.5
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

vendor_debian7.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.