NetSight
IP …
low3.5

CVE-2012-3865

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Dele…

Impact

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.

Affected products

VendorProductAffected versions
PuppetPuppet
Versions 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.8
PuppetlabsPuppet
through 2.7.17
through 2.6.16
Versions 2.7.0, 2.7.1
PuppetPuppet Enterprise
through 2.5.1

Weakness classification

CWE-22

References