Puppet Agent
Vendor:
First CVE: Jun 10, 2016 · Active for 10 years
8
Total CVEs
More Total CVEs than 85% of tracked products
1.6
Avg CVEs / Year
Higher CVE frequency than 59% of tracked products
8.2
Avg CVSS
Higher Avg CVSS than 72% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Puppet Agent over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 10, 2016
10 years ago
Most Recent CVE
Nov 18, 2021
1,709 days ago
CVE Severity & Scoring
Puppet Agent8 CVEs
38%
13%
50%
All CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network8 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (87.5%)
High1 (12.5%)
Unknown0 (0.0%)
User Interaction
None8 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low2 (25.0%)
High1 (12.5%)
None5 (62.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-2785CRITICAL Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restri | Jun 10, 2016 | 9.8 | 32 | NO | NO |
CVE-2021-27023CRITICAL A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018 | Nov 18, 2021 | 9.8 | 31 | NO | NO |
CVE-2016-5713CRITICAL Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow u | Dec 6, 2017 | 9.8 | 30 | NO | NO |
CVE-2016-2786CRITICAL The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote a | Jun 10, 2016 | 9.8 | 30 | NO | NO |
CVE-2016-5714HIGH Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbit | Oct 18, 2017 | 7.2 | 24 | NO | NO |
CVE-2021-27025MEDIUM A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'. | Nov 18, 2021 | 6.5 | 23 | NO | NO |
CVE-2020-7942MEDIUM Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to every | Feb 19, 2020 | 6.5 | 22 | NO | NO |
CVE-2015-1855MEDIUM verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which all | Nov 29, 2019 | 5.9 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Puppet Agent
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.4.1 | 1 | 9.8 | 2.9% | 0 | 0 |
| 1.3.5 | 1 | 9.8 | 1.6% | 0 | 0 |
| 1.3.4 | 1 | 9.8 | 1.6% | 0 | 0 |
| 1.3.2 | 1 | 9.8 | 1.6% | 0 | 0 |
| 1.3.1 | 1 | 9.8 | 1.6% | 0 | 0 |
| 1.3.0 | 1 | 9.8 | 1.6% | 0 | 0 |
| 1.0.0 | 1 | 5.9 | 2.8% | 0 | 0 |