Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2012-05-29T20:00:00
Updated: 2024-08-06T19:17:27.701Z
Reserved: 2012-04-02T00:00:00
Link: CVE-2012-1986
Vulnrichment
No data.
NVD
Status : Modified
Published: 2012-05-29T20:55:07.540
Modified: 2024-11-21T01:38:14.327
Link: CVE-2012-1986
Redhat