PT-2018-7109

CVE-2017-2297

·

Published

2018-02-01

·

Updated

2022-01-24

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions prior to 2016.4.5 Puppet Enterprise versions prior to 2017.2.1
Description: The issue concerns incorrect user authentication before returning labeled RBAC access tokens. This problem affects users with labeled tokens, which is not the default setting for tokens.
Recommendations: For Puppet Enterprise versions prior to 2016.4.5, update to version 2016.4.5 to resolve the issue. For Puppet Enterprise versions prior to 2017.2.1, update to version 2017.2.1 to resolve the issue.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-287: Improper Authentication
Related identifiers
CVE-2017-2297
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com