Vulnerability-Lookup

GHSA-XV72-7W5R-CQJW

Vulnerability from github – Published: 2022-05-24 17:11 – Updated: 2022-05-24 17:11

Details

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.4.0, Puppet Server 6.9.1 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects Puppet Enterprise 2018.1.x stream prior to 2018.1.13, and prior to 2019.4.0; Puppet Server prior to 6.9.1, and prior to 5.3.12; PuppetDB prior to 6.9.1, and prior to 5.2.13.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-7943"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-03-11T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 \u0026 2019.4.0, Puppet Server 6.9.1 \u0026 5.3.12, and PuppetDB 6.9.1 \u0026 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects Puppet Enterprise 2018.1.x stream prior to 2018.1.13, and prior to 2019.4.0; Puppet Server prior to 6.9.1, and prior to 5.3.12; PuppetDB prior to 6.9.1, and prior to 5.2.13.",
  "id": "GHSA-xv72-7w5r-cqjw",
  "modified": "2022-05-24T17:11:20Z",
  "published": "2022-05-24T17:11:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7943"
    },
    {
      "type": "WEB",
      "url": "https://puppet.com/security/cve/CVE-2020-7943"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2020-7943 (GCVE-0-2020-7943)

Vulnerability from cvelistv5 – Published: 2020-03-11 21:56 – Updated: 2024-08-04 09:48

Summary

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

Severity

No CVSS data available.

CWE

CWE-276 - Incorrect Default Permissions

Assigner

puppet

References

1 reference

URL	Tags
https://puppet.com/security/cve/CVE-2020-7943/	x_refsource_CONFIRM

Impacted products

5 products

Vendor	Product	Version
n/a	Puppet Enterprise 2018.1.x stream	Affected: prior to 2018.1.13
n/a	Puppet Enterprise	Affected: prior to 2019.5.0
n/a	Puppet Server	Affected: prior to 6.9.2 Affected: prior to 5.3.12
n/a	PuppetDB	Affected: prior to 6.9.1 Affected: prior to 5.2.13
n/a	Resolved in Puppet Enterprise, Puppet Server, PuppetDB	Affected: Puppet Enterprise 2018.1.13 and 2019.5.0 Affected: Puppet Server 6.9.2 and 5.3.12 Affected: PuppetDB 6.9.1 and 5.2.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:48:24.659Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://puppet.com/security/cve/CVE-2020-7943/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Puppet Enterprise 2018.1.x stream",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 2018.1.13"
            }
          ]
        },
        {
          "product": "Puppet Enterprise",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 2019.5.0"
            }
          ]
        },
        {
          "product": "Puppet Server",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 6.9.2"
            },
            {
              "status": "affected",
              "version": "prior to 5.3.12"
            }
          ]
        },
        {
          "product": "PuppetDB",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 6.9.1"
            },
            {
              "status": "affected",
              "version": "prior to 5.2.13"
            }
          ]
        },
        {
          "product": "Resolved in Puppet Enterprise, Puppet Server, PuppetDB",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Puppet Enterprise 2018.1.13 and 2019.5.0"
            },
            {
              "status": "affected",
              "version": "Puppet Server 6.9.2 and 5.3.12"
            },
            {
              "status": "affected",
              "version": "PuppetDB 6.9.1 and 5.2.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 \u0026 2019.5.0, Puppet Server 6.9.2 \u0026 5.3.12, and PuppetDB 6.9.1 \u0026 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276: Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-24T17:18:24.000Z",
        "orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e",
        "shortName": "puppet"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://puppet.com/security/cve/CVE-2020-7943/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@puppet.com",
          "ID": "CVE-2020-7943",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Puppet Enterprise 2018.1.x stream",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to 2018.1.13"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Puppet Enterprise",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to 2019.5.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Puppet Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to 6.9.2"
                          },
                          {
                            "version_value": "prior to 5.3.12"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "PuppetDB",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to 6.9.1"
                          },
                          {
                            "version_value": "prior to 5.2.13"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Resolved in Puppet Enterprise, Puppet Server, PuppetDB",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Puppet Enterprise 2018.1.13 and 2019.5.0"
                          },
                          {
                            "version_value": "Puppet Server 6.9.2 and 5.3.12"
                          },
                          {
                            "version_value": "PuppetDB 6.9.1 and 5.2.13"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 \u0026 2019.5.0, Puppet Server 6.9.2 \u0026 5.3.12, and PuppetDB 6.9.1 \u0026 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-276: Incorrect Default Permissions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://puppet.com/security/cve/CVE-2020-7943/",
              "refsource": "CONFIRM",
              "url": "https://puppet.com/security/cve/CVE-2020-7943/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e",
    "assignerShortName": "puppet",
    "cveId": "CVE-2020-7943",
    "datePublished": "2020-03-11T21:56:41.000Z",
    "dateReserved": "2020-01-23T00:00:00.000Z",
    "dateUpdated": "2024-08-04T09:48:24.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-XV72-7W5R-CQJW

CVE-2020-7943 (GCVE-0-2020-7943)

Tags

Sightings

Nomenclature