CVE

Id
57108  
CVE No.
CVE-2012-3865  
Status
Candidate  
Description
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.  
Phase
Assigned (20120706)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
590401 57108 CVE-2012-3865 CONFIRM:http://puppetlabs.com/security/cve/cve-2012-3865/  View
590402 57108 CVE-2012-3865 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=839131  View
590403 57108 CVE-2012-3865 CONFIRM:https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f  View
590404 57108 CVE-2012-3865 CONFIRM:https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6  View
590405 57108 CVE-2012-3865 DEBIAN:DSA-2511  View
590406 57108 CVE-2012-3865 URL:http://www.debian.org/security/2012/dsa-2511  View
590407 57108 CVE-2012-3865 SUSE:SUSE-SU-2012:0983  View
590408 57108 CVE-2012-3865 URL:http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html  View
590409 57108 CVE-2012-3865 SUSE:openSUSE-SU-2012:0891  View
590410 57108 CVE-2012-3865 URL:http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html  View
590411 57108 CVE-2012-3865 UBUNTU:USN-1506-1  View
590412 57108 CVE-2012-3865 URL:http://www.ubuntu.com/usn/USN-1506-1  View
590413 57108 CVE-2012-3865 SECUNIA:50014  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
30128 JVNDB-2012-005835 Open Constructor におけるクロスサイトスクリプティングの脆弱性 Open Constructor の objects/createobject.php には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2012-3870 57108 3.5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-005835.html  View