Puppet vulnerabilities

Products

• Enterprise 89
• Puppet 42
• Enterprise 16
• Agent 8
• Server 7
• Agent 6
• Bolt 4
• Continuous Delivery 4
• Marionette Collective 3
• Mcollective 3
• Puppetdb 3
• Puppetlabs-mysql 3
• Server 3
• Discovery 2
• Facter 2
• Discovery 2

Newest

• perforce puppet enterprise, puppet enterprise +1 more OS Command Injection CVE-2025-5459 8.6 HighJune 26, 2025
• puppet peadm forge module Security Misconfiguration in Forge module PEADM CVE-2024-9160 5.4 MediumSeptember 27, 2024
• perforce puppet enterprise, puppet enterprise +1 more Broken Session Management in Puppet Enterprise CVE-2023-5309 6.8 MediumNovember 7, 2023
• puppet bolt CVE-2023-5214 - Privilege Escalation in Puppet Bolt CVE-2023-5214 Fix available 6.5 MediumOctober 6, 2023
• puppet server, perforce puppet enterprise, puppet enterprise +2 more Denial of Service for Revocation of Auto Renewed Certificates CVE-2023-5255 4.4 MediumOctober 3, 2023
• perforce puppet enterprise, puppet enterprise +1 more A privilege escalation allowing remote code execution was discovered in the orchestration service. CVE-2023-2530 9.8 CriticalJune 7, 2023
• puppet server, perforce puppet enterprise, puppet enterprise +2 more A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2... CVE-2023-1894 Fix available 5.3 MediumMay 4, 2023
• puppet puppetlabs-mysql Puppetlabs-mysql Command Injection CVE-2022-3276 Fix available 8.4 HighOctober 7, 2022
• puppet puppetlabs-apt, fedoraproject fedora, puppet puppetlabs-mysql +2 more Puppetlabs-apt Command Injection CVE-2022-3275 Fix available 8.4 HighOctober 7, 2022
• perforce puppet bolt, puppet bolt +1 more Sensitive Parameter Exposure in Puppet Bolt prior to 3.24 CVE-2022-2394 4.1 MediumJuly 19, 2022
• puppet firewall, firewall module +1 more Puppet Firewall Module May Leave Unmanaged Rules CVE-2022-0675 Fix available 5.6 MediumMarch 2, 2022
• puppet agent, server, fedoraproject fedora +1 more +3 more Unsafe HTTP Redirect in Puppet Agent and Puppet Server CVE-2021-27023 Fix available 9.8 CriticalNovember 18, 2021
• puppet, puppet agent, fedoraproject fedora +1 more +3 more Silent Configuration Failure in Puppet Agent CVE-2021-27025 Fix available 6.5 MediumNovember 18, 2021
• puppet, puppet enterprise, connect +2 more A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters... CVE-2021-27026 4.4 MediumNovember 18, 2021
• puppet continuous delivery A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user... CVE-2021-27024 8.1 HighNovember 18, 2021
• perforce puppet enterprise, puppet, puppet enterprise +2 more A flaw was discovered in bolt-server and ace where running a task with sensitive parameters... CVE-2021-27022 4.9 MediumSeptember 7, 2021
• puppet remediate The mechanism which performs certificate validation was discovered to have a flaw that resulted... CVE-2021-27018 7.5 HighAugust 30, 2021
• puppet puppetdb, enterprise +1 more PuppetDB logging included potentially sensitive system information. CVE-2021-27019 Fix available 4.3 MediumAugust 30, 2021
• perforce puppet enterprise, puppet enterprise +1 more Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. CVE-2021-27020 8.8 HighAugust 30, 2021
• puppet, puppet enterprise, puppetdb +2 more A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows... CVE-2021-27021 Fix available 8.8 HighJuly 20, 2021
• puppet continuous delivery Local registry credentials were included directly in the CD4PE deployment definition, which could... CVE-2020-7945 5.5 MediumSeptember 18, 2020
• bolt The filename of uploaded files vulnerable to stored XSS in Bolt CMS CVE-2020-4041 Fix available 7.4 HighJune 8, 2020
• bolt CSRF issue on preview pages in Bolt CMS CVE-2020-4040 Public exploitFix available 8.6 HighJune 8, 2020
• puppet continuous delivery In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or... CVE-2020-7944 7.7 HighMarch 26, 2020
• perforce puppet enterprise, puppet server, enterprise +1 more +3 more Puppet Server and PuppetDB provide useful performance and debugging information via their metrics... CVE-2020-7943 Fix available 7.5 HighMarch 11, 2020
• puppet enterprise Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF ... CVE-2015-5686 8.8 HighFebruary 27, 2020
• puppet, puppet agent, puppetpu puppet agent +2 more Improper Certificate Validation in Puppet CVE-2020-7942 Fix available 6.5 MediumFebruary 19, 2020
• puppet server Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to... CVE-2018-11751 Fix available 5.4 MediumDecember 16, 2019
• mcollective, debian linux, puppet marionette collective +1 more +3 more mcollective has a default password set at install CVE-2014-0175 Fix available 9.8 CriticalDecember 13, 2019
• puppet continuous delivery When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE... CVE-2019-10695 6.5 MediumDecember 11, 2019
• perforce puppet enterprise, puppet enterprise +1 more The express install, which is the suggested way to install Puppet Enterprise, gives the user a... CVE-2019-10694 9.8 CriticalDecember 11, 2019
• puppet enterprise Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via... CVE-2013-4968 6.1 MediumDecember 11, 2019
• puppet discovery Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx... CVE-2018-11747 9.8 CriticalMarch 17, 2019
• puppet chloride Improper Certificate Validation in chloride CVE-2018-6517 Fix available 7.5 HighMarch 17, 2019
• puppet cisco ios Previous releases of the Puppet cisco_ios module output SSH session debug information including... CVE-2018-11752 5.5 MediumOctober 2, 2018
• puppet cisco ios module Previous releases of the Puppet cisco_ios module did not validate a host's identity before... CVE-2018-11750 6.5 MediumOctober 2, 2018
• puppet device manager Previous releases of the Puppet device_manager module creates configuration files containing... CVE-2018-11748 7.8 HighOctober 2, 2018
• perforce puppet enterprise, puppet enterprise +1 more When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials... CVE-2018-11749 9.8 CriticalAugust 24, 2018
• puppet discovery Puppet Discovery can leak authentication information CVE-2018-11746 8.6 HighJuly 3, 2018
• puppet pe-client-tools, enterprise client tools +1 more On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE... CVE-2018-6516 7.8 HighJune 14, 2018
• puppet, puppet agent, puppetpu puppet agent +2 more Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x... CVE-2018-6515 7.8 HighJune 11, 2018
• puppet, puppet agent, puppetpu puppet agent +2 more In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x... CVE-2018-6514 7.8 HighJune 11, 2018
• puppet, puppet enterprise, enterprise and puppet agent +2 more Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7,... CVE-2018-6513 8.8 HighJune 11, 2018
• puppet pe-razor-server, enterprise, razor-server +1 more +3 more The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when... CVE-2018-6512 9.8 CriticalJune 11, 2018
• perforce puppet enterprise, puppet enterprise +1 more XSS Vulnerability in Puppet Enterprise Console CVE-2018-6511 5.4 MediumMay 8, 2018
• perforce puppet enterprise, puppet enterprise +1 more XSS Vulnerability in Puppet Enterprise Console CVE-2018-6510 5.4 MediumMay 8, 2018
• perforce puppet enterprise, puppet enterprise, puppetlabs/apache +4 more +6 more Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a... CVE-2018-6508 Fix available 8.0 HighFebruary 9, 2018
• perforce puppet enterprise, puppet, puppet agent +3 more +5 more In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an... CVE-2017-10690 Fix available 6.5 MediumFebruary 9, 2018
• perforce puppet enterprise, puppet enterprise +1 more Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users... CVE-2017-2297 7.5 HighFebruary 1, 2018
• perforce puppet enterprise, puppet enterprise +1 more In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain... CVE-2017-2296 6.5 MediumFebruary 1, 2018
• Show olderLoading…