VulnerabilityModified

CVE-2014-9355

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint.

MEDIUM 4.0EPSS 0.61%

Does this matter?

Lower severity and a low EPSS score (0.61%). Track it; it rarely justifies an emergency change on its own.

Description

Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint.

CVSS 2.0: 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
EPSS: 0.61% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: puppet/puppet enterprise
Source: cve@mitre.org

References

http://puppetlabs.com/security/cve/cve-2014-9355Vendor Advisory
http://secunia.com/advisories/61265
http://puppetlabs.com/security/cve/cve-2014-9355Vendor Advisory
http://secunia.com/advisories/61265

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.