Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 01:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html - | |
| References | () http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html - | |
| References | () http://puppetlabs.com/security/cve/cve-2012-3865/ - Vendor Advisory | |
| References | () http://secunia.com/advisories/50014 - | |
| References | () http://www.debian.org/security/2012/dsa-2511 - | |
| References | () http://www.ubuntu.com/usn/USN-1506-1 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=839131 - | |
| References | () https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f - Exploit, Patch | |
| References | () https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6 - Exploit, Patch |
Information
Published : 2012-08-06 16:55
Updated : 2024-11-21 01:41
NVD link : CVE-2012-3865
Mitre link : CVE-2012-3865
CVE.ORG link : CVE-2012-3865
JSON object : View
Products Affected
puppet
- puppet_enterprise
- puppet
puppetlabs
- puppet
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')