NVD

Id
45391  
Name
CVE-2012-3865  
Description
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.  
Reject
 
CVSS Version
2  
CVSS Score
3.5  
Severity
Low  
CVSS Base Score
3.5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2012-08-06  
Modified Date
2014-10-10  
Seq
2012-3865  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
227870 45391 CVE-2012-3865 SUSE-SU-2012:0983  View
227871 45391 CVE-2012-3865 openSUSE-SU-2012:0891  View
227872 45391 CVE-2012-3865 http://puppetlabs.com/security/cve/cve-2012-3865/  View
227873 45391 CVE-2012-3865 DSA-2511  View
227874 45391 CVE-2012-3865 USN-1506-1  View
227875 45391 CVE-2012-3865 https://bugzilla.redhat.com/show_bug.cgi?id=839131  View
227876 45391 CVE-2012-3865 https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f  View
227877 45391 CVE-2012-3865 https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27785 JVNDB-2012-003492 Puppet および Puppet Enterprise におけるディレクトリトラバーサルの脆弱性 Puppet および Puppet Enterprise の lib/puppet/reports/store.rb には、auth.conf 内の Delete が有効である場合、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2012-3865 57103 CVE-2012-3865 45391 3.5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003492.html 2012-08-06 2012-09-14 View