CVE-2017-10690

In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://access.redhat.com/errata/RHSA-2018:2927	Third Party Advisory
https://puppet.com/security/cve/CVE-2017-10690	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:puppet:puppet::::::::
	cpe:2.3:a:puppet:puppet_enterprise::::::::

Configuration 2 (hide)

cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-02-09 20:29

Updated : 2024-02-28 16:25

NVD link : CVE-2017-10690

Mitre link : CVE-2017-10690

CVE.ORG link : CVE-2017-10690

JSON object : View

Products Affected

redhat

satellite

puppet

puppet_enterprise
puppet

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2017-10690", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-02-09T20:29:00.270", "references": [{"url": "https://access.redhat.com/errata/RHSA-2018:2927", "tags": ["Third Party Advisory"], "source": "security@puppet.com"}, {"url": "https://puppet.com/security/cve/CVE-2017-10690", "tags": ["Vendor Advisory"], "source": "security@puppet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4"}, {"lang": "es", "value": "En versiones anteriores de Puppet Agent, era posible que el agente recuperase hechos de un entorno para el que no estaba clasificado. Esto se solucion\u00f3 en Puppet Agent 5.3.4, incluido en Puppet Enterprise 2017.3.4."}], "lastModified": "2022-01-24T16:46:01.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10D3BEEC-EBCB-44C6-AA87-7BF082B1CE2C", "versionEndExcluding": "5.3.4"}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F819975-5B9D-45BD-81E7-1CE986D14183", "versionEndExcluding": "2017.3.4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB283C80-F7AF-4776-8432-655E50D7D65B"}], "operator": "OR"}]}], "sourceIdentifier": "security@puppet.com"}