CVE-2015-7224

puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-12-21

Last modified

2024-08-06

Weaknesses

CWE-287

Affected products

• Puppetlabs-mysql (Puppet)

References

• https://puppet.com/security/cve/CVE-2015-7224