QwikSec

Security Database

CVE

CWE

Training

CVE-2012-3865

Published: Aug 6, 2012

Modified: Aug 6, 2024

PUBLISHED

Description

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

SUSE-SU-2012:0983

vendor-advisory

x_refsource_SUSE

https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f

x_refsource_CONFIRM

vendor-advisory

x_refsource_DEBIAN

vendor-advisory

x_refsource_UBUNTU

third-party-advisory

x_refsource_SECUNIA

openSUSE-SU-2012:0891

vendor-advisory

x_refsource_SUSE

https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6

x_refsource_CONFIRM

https://bugzilla.redhat.com/show_bug.cgi?id=839131

x_refsource_CONFIRM

http://puppetlabs.com/security/cve/cve-2012-3865/

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.