CVE-2012-3865
Puppet vulnerable to Path Traversal
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
- Record
CVE-2012-3865- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:N/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
- Record
CVE-2012-3865- Updated
- 2026-11-02
EUVDEUVD-2017-0235 No score
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
- Record
EUVD-2017-0235- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g89m-3wjw-h857 No score
Puppet vulnerable to Path Traversal
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
- Record
GHSA-g89m-3wjw-h857- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
- Record
CVE-2012-3865- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3865 No score
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
- Record
DEBIAN-CVE-2012-3865- Updated
- 2026-11-02
OSVGHSA-g89m-3wjw-h857 No score
Puppet vulnerable to Path Traversal
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
- Record
GHSA-g89m-3wjw-h857- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10581-1 No score
ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media
These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10581-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetRubyGems |
before 2.6.17 | 2.6.17 |
puppetRubyGems |
2.7.0 up to 2.7.18 | 2.7.18 |
puppetDebian:11 |
before 2.7.18-1 | 2.7.18-1 |
puppetDebian:6.0 From an advisory covering 4 CVEs |
before 2.6.2-5+squeeze6, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze42.6.2-5+squeeze5 |
2.6.2-5+squeeze6 |
puppetRubyGems |
before 2.6.17, plus listed versions 0.13.00.13.10.13.20.13.60.16.0 Show 39 moreShow less0.18.40.22.40.23.00.23.10.23.20.24.00.24.10.24.20.24.30.24.40.24.50.24.60.24.70.24.80.24.90.25.00.25.10.25.20.25.30.25.40.25.50.9.22.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9 |
2.6.17 |
puppetRubyGems |
2.7.0 up to 2.7.18, plus listed versions 2.7.12.7.112.7.122.7.132.7.14 Show 8 moreShow less2.7.162.7.172.7.32.7.42.7.52.7.62.7.82.7.9 |
2.7.18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3865 is a low vulnerability (CVSS 3.5) in Puppet, published July 12, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in puppet 2.6.17.
References
lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f
debian.org/security/2012/dsa-2511
ubuntu.com/usn/USN-1506-1
secunia.com/advisories/50014
Show 21 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=839131
puppetlabs.com/security/cve/cve-2012-3865
nvd.nist.gov/vuln/detail/CVE-2012-3865
puppet.com/security/cve/overview-cve-2012-3865-arbitrary-file-delete/dos-puppet-master
security-tracker.debian.org/tracker/CVE-2012-3865
suse.com/security/cve/CVE-2011-3848