What is CVE-2017-2297?

CVE-2017-2297 is a high-severity vulnerability in Puppet Enterprise, classified under Improper Authentication. CVSS score: 7.5/10. Published 2018-02-01.

How severe is CVE-2017-2297?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Puppet Enterprise

CVE-2017-2297

Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5 and 2017.2.1. This only affects users with…

Vulnerability class: Broken Authentication

EPSS: 0.006 (46.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Puppet Enterprise — versions 2016.4.x prior to 2016.4.5, 2016.5.x, 2017.1.x
Puppet Puppet_enterprise — versions 2016.5.1, 2016.5.2, 2017.1.0

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

security@puppet.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-2297?: CVE-2017-2297 is a high-severity vulnerability in Puppet Enterprise, classified under Improper Authentication. CVSS score: 7.5/10. Published 2018-02-01.
How severe is CVE-2017-2297?: High severity. CVSS v3 base score is 7.5 out of 10.