VulnerabilityModified
CVE-2022-0675
This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.
CRITICAL 9.8EPSS 0.92%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.92% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1289, CWE-20
- Affected
- puppet/firewall
- Source
- security@puppet.com
References
- https://puppet.com/security/cve/CVE-2022-0675Vendor Advisory
- https://puppet.com/security/cve/CVE-2022-0675Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.