CVE-2016-2785

critical

Description

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

References

https://github.com/advisories/GHSA-pqj5-7r86-64fv

https://security.gentoo.org/glsa/201606-02

https://puppet.com/security/cve/cve-2016-2785

https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4807

Details

Source: Mitre, NVD

Published: 2016-06-10

Updated: 2026-05-06

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.02889

Detections

Analytics