Vulnerability Details CVE-2016-2786
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 71.0%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
Products affected by CVE-2016-2786
-
cpe:2.3:a:puppet:puppet_agent:1.3.0
-
cpe:2.3:a:puppet:puppet_agent:1.3.1
-
cpe:2.3:a:puppet:puppet_agent:1.3.2
-
cpe:2.3:a:puppet:puppet_agent:1.3.4
-
cpe:2.3:a:puppet:puppet_agent:1.3.5
-
cpe:2.3:a:puppet:puppet_enterprise:2015.3.0
-
cpe:2.3:a:puppet:puppet_enterprise:2015.3.2