CVE-2023-5309

CWE-3843 documents3 sources
Severity
9.8CRITICAL
EPSS
0.3%
top 47.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Puppet Puppet Enterprise
Timeline
PublishedNov 7

Description

Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 1.6 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5puppet/puppet_enterprise2021.7.0 — 2021.7.6+1
▶NVDpuppet/puppet_enterprise2023.0 — 2023.5.0+1

🔴Vulnerability Details

2
CVEList
Broken Session Management in Puppet Enterprise↗2023-11-07
▶
GHSA
GHSA-c7r6-m4rr-fqqm: Versions of Puppet Enterprise prior to 2021↗2023-11-07
▶