CVE-2015-7328

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors.

CVSS v3 4.7 MEDIUM
CVSS v2.0 1.9 LOW

4.7^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://puppetlabs.com/security/cve/cve-2015-7328	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:puppet:puppet_enterprise:3.8.0:::::::*
	cpe:2.3:a:puppet:puppet_enterprise:3.8.1:::::::*
	cpe:2.3:a:puppet:puppet_enterprise:3.8.2:::::::*
	cpe:2.3:a:puppet:puppet_enterprise:2015.2.0:::::::*
	cpe:2.3:a:puppet:puppet_enterprise:2015.2.1:::::::*
	cpe:2.3:a:puppet:puppet_enterprise:2015.2.2:::::::*

History

No history.

Information

Published : 2016-01-08 19:59

Updated : 2024-02-28 15:21

NVD link : CVE-2015-7328

Mitre link : CVE-2015-7328

CVE.ORG link : CVE-2015-7328

JSON object : View

Products Affected

puppet

puppet_enterprise

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2015-7328", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2016-01-08T19:59:03.723", "references": [{"url": "https://puppetlabs.com/security/cve/cve-2015-7328", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors."}, {"lang": "es", "value": "Puppet Server en Puppet Enterprise en versiones anteriores a 3.8.x en versiones anteriores a 3.8.3 y 2015.2.x en versiones anteriores a 2015.2.3 utiliza permisos world-readable para la clave privada del certificado de la Autoridad de Certificaci\u00f3n (CA) durante la instalaci\u00f3n inicial y configuraci\u00f3n, lo que podr\u00eda permitir a usuarios locales obtener informaci\u00f3n sensible a trav\u00e9s de vectores no especificados."}], "lastModified": "2019-07-10T15:40:05.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0115B62-078B-43C7-AD21-45C12B8298FC"}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "627BABD8-83A4-4913-A36A-8918ADBF3D68"}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.8.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E616AF3E-FC04-4E45-A953-951072ECF71A"}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2015.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D314EA4C-0CF5-49DD-AE91-A69D07BBE3FD"}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2015.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B73DBBF-D30F-49FB-8564-7DB6E4EAC945"}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2015.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8032AD3-4956-4432-B0E0-1CCAD521C370"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}