CVE-2022-2394
Sensitive Parameter Exposure in Puppet Bolt prior to 3.24
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Sensitive Parameter Exposure in Puppet Bolt prior to 3.24
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
- Record
CVE-2022-2394- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-34659
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
- Record
EUVD-2022-34659- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-prvj-qfjv-3x3f
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting...
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
- Record
GHSA-prvj-qfjv-3x3f- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-532
- Updated
- 2026-11-02
NVD
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
- Record
CVE-2022-2394- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-532
- Updated
- 2026-11-02
OSV
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
- Record
CVE-2022-2394- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2394 is a medium vulnerability (CVSS 4.1) in Perforce Puppet Bolt, published July 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. No source names a fixed version.