CVE-2011-0528 json
Puppet does not properly restrict access to node resources
published 2014-02-17 12 y ago modified 2026-06-16 4 mo ago also GHSA-9pvx-fwwh-w289 , EUVD-2022-3428
- cvss
- 5.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.
Patch / fix
Exploit prediction
1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:P/I:P/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | puppet | >=2.6.0, <2.6.4 |
2.6.4 |
Classification
References
-
github.com
/puppetlabs/puppet/commit/eee1a9cdaa5cab6222c8e6ab087d319f976fa4e3
web
-
ubuntu.com
/usn/USN-1365-1
vendor-advisory, web
-
openwall.com
/lists/oss-security/2011/01/27/6
mailing-list, web
-
mail-archive.com
/puppet-users%40googlegroups.com/msg16429.html
mailing-list
-
openwall.com
/lists/oss-security/2011/01/31/5
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2011-0528
advisory
-
github.com
/puppetlabs/puppet
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2011-0528.yml
web
-
mail-archive.com
/puppet-users@googlegroups.com/msg16429.html
web
Sources
- CVE List CVE-2011-0528
- GitHub Advisory GHSA-9pvx-fwwh-w289
- NVD CVE-2011-0528
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.