CVE-2020-7943

HIGHNuclei

Puppet Server/PuppetDB - Sensitive Information Disclosure

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-7943 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

5
ProductSourceVersion range

Puppet Enterprise

CVE Listprior to 2019.5.0affected

Puppet Enterprise 2018.1.x stream

CVE Listprior to 2018.1.13affected

Puppet Server

CVE Listprior to 6.9.2affected
prior to 5.3.12affected

PuppetDB

CVE Listprior to 6.9.1affected
prior to 5.2.13affected

Resolved in Puppet Enterprise, Puppet Server, PuppetDB

CVE ListPuppet Enterprise 2018.1.13 and 2019.5.0affected
Puppet Server 6.9.2 and 5.3.12affected
PuppetDB 6.9.1 and 5.2.13affected

Nuclei templates

1
ProjectDiscoveryHIGHPuppet Server/PuppetDB - Sensitive Information DisclosureCVSS 7.5

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints, which may contain sensitive information when left exposed.

Impact

An attacker can exploit this vulnerability to gain access to sensitive information stored in Puppet Server/PuppetDB.

Remediation

Apply the necessary patches or updates provided by Puppet to fix the vulnerability and ensure sensitive information is properly protected.

WeaknessesCWE-276
Authorsc-sh0
Template tagscve2020cvepuppetexposurepuppetdbvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*
https://puppet.com/security/cve/CVE-2020-7943 https://tickets.puppetlabs.com/browse/PDB-4876 https://puppet.com/security/cve/CVE-2020-7943/ https://nvd.nist.gov/vuln/detail/CVE-2020-7943 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2