NetSight
IP …
low2.1

CVE-2012-3866

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local us…

Impact

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

Affected products

VendorProductAffected versions
PuppetPuppet
Versions 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.8
PuppetlabsPuppet
through 2.7.17
Versions 2.7.0, 2.7.1
PuppetPuppet Enterprise
through 2.5.1

Weakness classification

CWE-264

References