PT-2017-7194 · Puppet · Mcollective-Puppet-Agent

Publicado 2017-01-30 · Atualizado 2017-02-24 · CVE-2015-7331

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions mcollective-puppet-agent plugin versions prior to 1.11.1

Description The issue allows remote attackers to execute arbitrary code. This is achieved through vectors involving the --server argument.

Recommendations For versions prior to 1.11.1, update to version 1.11.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the --server argument until a patch is available.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2015-7331

Produtos afetados

Mcollective-Puppet-Agent

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-7331 · Nota de Segurança
• http://securityfocus.com/bid/92432 · Nota
• https://puppet.com/security/cve/cve-2015-7331 · Aviso do Fabricante