CVE-2015-4100

Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master, aka a "Certificate Authority Reverse Proxy Vulnerability."

Score

CVSS 3.0 6.8 Medium

Status

Modified - cve@mitre.org

Published

2017-12-21

Last modified

2024-08-06

Weaknesses

CWE-295

Affected products

• Puppet Enterprise (Puppet)

References

• https://puppet.com/security/cve/CVE-2015-4100