CVE-2017-10690 Missing authorization in Puppet Agent
Puppet Agent allowed unauthorized retrieval of facts from restricted environments, enabling attackers to access sensitive configuration data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-10690?
CVE-2017-10690 is a medium-severity missing authorization vulnerability in Puppet Puppet Enterprise, published on 9 Feb 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4
Weakness: CWE-269
Which versions are affected by CVE-2017-10690?
It affects 3 products.
Products include Puppet Puppet, Puppet Puppet Enterprise, Redhat Satellite.
How do I fix CVE-2017-10690?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-10690 being exploited?
There is no known exploitation of CVE-2017-10690 in the wild and no public exploit code.
Other vulnerabilities in Puppet Puppet Enterprise
Sources
Also known as GHSA-v5m5-pcq8-cjj7.