NVD

Id
18774  
Name
CVE-2016-2786  
Description
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-06-10  
Modified Date
2016-06-14  
Seq
2016-2786  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
103846 18774 CVE-2016-2786 https://puppet.com/security/cve/CVE-2016-2786  View
103847 18774 CVE-2016-2786 GLSA-201606-02  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2375 JVNDB-2016-003148 Puppet Enterprise および Puppet Agent の pxp-agent コンポーネントにおけるブローカを偽造される脆弱性 Puppet Enterprise および Puppet Agent の pxp-agent コンポーネントは、サーバの証明書を適切に検証しないため、ブローカを偽造され、任意のコマンドを実行される脆弱性が存在します。 CVE-2016-2786 89292 CVE-2016-2786 18774 7.5 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003148.html 2016-03-14 2016-06-16 View