CVE-2012-1986

CVE-2012-1986 is a vulnerability affecting Puppet versions 2.6.x before 2.6.15 and 2.7.x before 2.7.13, as well as several Puppet Enterprise versions. It allows remote authenticated users with specific permissions and an authorized SSL key to read arbitrary files on the Puppet master. The attack involves a symlink attack combined with a crafted REST request to a filebucket. The vulnerability has a CVSS 2.1 score of None, indicating a low severity, with an attack vector of Network, high attack complexity, and requiring authentication. The potential impact is limited to partial confidentiality, allowing unauthorized file reading. There is no evidence of active exploitation, nor is exploit code available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public attention.