What is CVE-2015-1029?

CVE-2015-1029 is a vulnerability in Puppet Enterprise, classified under CWE-264. Published 2015-01-16.

Is CVE-2015-1029 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Puppet Enterprise

CVE-2015-1029

The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.

Published 2015-01-16 · last modified 2026-06-17.

CVSS v2 metric

CVSS v2 base score 6.5 (Medium). Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.016 (75.5th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 75.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000

Affected products

Puppet Enterprise
Puppet Stdlib — versions 2.1.0, 2.1.1, 2.1.2

Weakness classification (CWE)

CWE-264

Public proof-of-concept exploits

puppetlabs/puppetlabs-compliance_

References

puppetlabs.com/security/cve/cve-2015-1029 (Vendor Advisory)
secunia.com/advisories/62328 (third-party-advisory)

Frequently asked questions

What is CVE-2015-1029?: CVE-2015-1029 is a vulnerability in Puppet Enterprise, classified under CWE-264. Published 2015-01-16.
Is CVE-2015-1029 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.