CVE-2016-2785 json
Puppet Improper Access Control
published 2016-06-10 10 y ago modified 2026-06-17 4 mo ago also GHSA-pqj5-7r86-64fv , EUVD-2022-4807
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.9%
- EPSS 2.9% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
Patch / fix
- rubygems puppet 4.4.2
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-2785 updated cvss 5.0
puppet: incorrect URL decoding
-
Red Hat OpenStack Foreman puppet Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) puppet Red Hat Enterprise Linux OpenStack Platform 6 (Juno) puppet Red Hat Enterprise Linux OpenStack Platform 6 (Juno) Installer puppet Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) puppet, puppet-server Red Hat OpenStack Platform 8 (Liberty) puppet, puppet-serveraffected: no fix planned “Will not fix”
-
Red Hat Ceph Storage 1.3 puppet Red Hat Satellite 6 puppet, puppet-server Red Hat Subscription Asset Manager puppetnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.89% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | puppet | >=4.0.0, <4.4.2 |
4.4.2 |
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2
vendor-advisory
-
github.com
/puppetlabs/puppet/commit/6592a8166572e5f1b7d058474059b8519ec81387
web
-
security.gentoo.org
/glsa/201606-02
vendor-advisory, web, third-party-advisory
-
puppet.com
/security/cve/cve-2016-2785
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2016-2785
advisory
-
github.com
/puppetlabs/puppet
package
-
github.com
/puppetlabs/puppet/commits/4.4.2
web
Sources
- CVE List CVE-2016-2785
- GitHub Advisory GHSA-pqj5-7r86-64fv
- NVD CVE-2016-2785
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.