CVE-2015-7224 Auth bypass in n/a
Remote attackers can bypass authentication in Puppet MySQL module by exploiting netmask handling in user parameters to create passwordless database accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-7224?
CVE-2015-7224 is a critical authentication bypass vulnerability in n/a, published on 21 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.
Weakness: CWE-287
Which versions are affected by CVE-2015-7224?
It affects 1 product.
Products include Puppet Puppetlabs-Mysql.
How do I fix CVE-2015-7224?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2015-7224 being exploited?
There is no known exploitation of CVE-2015-7224 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2015-7224, GHSA-cg6c-24mc-jmx8.