Puppet Server
Vendor:
First CVE: Dec 17, 2014 · Active for 11 years
7
Total CVEs
More Total CVEs than 83% of tracked products
1.2
Avg CVEs / Year
Higher CVE frequency than 55% of tracked products
6.7
Avg CVSS
Higher Avg CVSS than 36% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Puppet Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 17, 2014
11 years ago
Most Recent CVE
Oct 3, 2023
1,025 days ago
CVE Severity & Scoring
Puppet Server7 CVEs
14%
29%
29%
29%
All CVEs352,101 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network5 (71.4%)
Unknown1 (14.3%)
Physical0 (0.0%)
Adjacent Network1 (14.3%)
Attack Complexity
Low6 (85.7%)
High0 (0.0%)
Unknown1 (14.3%)
User Interaction
None6 (85.7%)
Unknown1 (14.3%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None6 (85.7%)
Unknown1 (14.3%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-2785CRITICAL Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restri | Jun 10, 2016 | 9.8 | 32 | NO | NO |
CVE-2021-27023CRITICAL A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018 | Nov 18, 2021 | 9.8 | 31 | NO | NO |
CVE-2020-7943HIGH Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server | Mar 11, 2020 | 7.5 | 31 | NO | YES |
CVE-2023-5255HIGH For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. | Oct 3, 2023 | 7.5 | 22 | NO | NO |
CVE-2023-1894MEDIUM A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names signif | May 4, 2023 | 5.3 | 20 | NO | NO |
CVE-2018-11751MEDIUM Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. | Dec 16, 2019 | 5.4 | 19 | NO | NO |
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service. | Dec 17, 2014 | 1.9 | 11 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
14.3% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Puppet Server
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 8.2.1 | 1 | 7.5 | 0.4% | 0 | 0 |
| 8.2.0 | 1 | 7.5 | 0.4% | 0 | 0 |
| 7.9.2 | 1 | 5.3 | 0.4% | 0 | 0 |
| 2.3.1 | 1 | 9.8 | 2.9% | 0 | 0 |
| 2.3.0 | 1 | 9.8 | 2.9% | 0 | 0 |
| 2.2.0 | 1 | 9.8 | 2.9% | 0 | 0 |
| 2.1.2 | 1 | 9.8 | 2.9% | 0 | 0 |
| 2.1.1 | 1 | 9.8 | 2.9% | 0 | 0 |
| 2.1.0 | 1 | 9.8 | 2.9% | 0 | 0 |
| 2.0.0 | 1 | 9.8 | 2.9% | 0 | 0 |
| 0.2.0 | 1 | 1.9 | 0.2% | 0 | 0 |