Vulnerability in Puppet Puppetdb

CVE-2020-7943

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which…

EPSS: 0.079 (94.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

  • Puppet Puppetdb
  • Puppet Puppet_enterprise
  • Puppet Puppet_server
  • N/a Puppetdb — versions prior to 6.9.1, prior to 5.2.13
  • N/a Puppet Enterprise — versions prior to 2019.5.0
  • N/a Puppet Enterprise 2018.1.x Stream — versions prior to 2018.1.13
  • N/a Puppet Server — versions prior to 6.9.2, prior to 5.3.12
  • N/a Resolved In Puppet Enterprise, Server, Puppetdb — versions Puppet Enterprise 2018.1.13 and 2019.5.0, Puppet Server 6.9.2 and 5.3.12, PuppetDB 6.9.1 and 5.2.13

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2020-7943?
CVE-2020-7943 is a high-severity vulnerability in Puppet Puppetdb, classified under Incorrect Default Permissions. CVSS score: 7.5/10. Published 2020-03-11.
How severe is CVE-2020-7943?
High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2020-7943 known to be exploited?
5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.