Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501.

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x or 2016.x prior to 2016.4.0. It is, therefore, affected by the following vulnerabilities :

  - A cross-site redirection vulnerability exists within the     /auth/login script due to improper validation of     user-supplied input to the 'redirect' parameter in a GET     request. An unauthenticated, remote attacker can exploit     this issue, by convincing a user to follow a specially     crafted link, to redirect the user to a website of the     attacker's own choosing, which can then be used to     conduct further attacks. Note that this vulnerability     was thought to have been resolved by the fix for     CVE-2015-6501, but the fix was incomplete. Puppet     Enterprise 2016.4.0 includes a fix for this     vulnerability. (CVE-2016-5715)

  - A flaw exists in the Puppet Enterprise Console due to     unsafe string processing that allows an authenticated,     remote attacker to execute arbitrary code.

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version prior to 2016.2.1. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability exists in the environment     catalog component. An unauthenticated remote attacker can exploit     this issue to retrieve access to the enviroment catalogs which     may reveal sensitive information about infrastructure of application     orchestration users.(CVE-2016-5714)

  - An url redirection vulnerability exists in the next page transition.     An unauthenticated remote attacker can exploit     this issue to create believable phishing attacks.(CVE-2016-5715)

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x or 2016.x prior to 2016.4.0. It is, therefore, affected by the following vulnerabilities :

  - A cross-site redirection vulnerability exists within the     /auth/login script due to improper validation of     user-supplied input to the 'redirect' parameter in a GET     request. An unauthenticated, remote attacker can exploit     this issue, by convincing a user to follow a specially     crafted link, to redirect the user to a website of the     attacker's own choosing, which can then be used to     conduct further attacks. Note that this vulnerability     was thought to have been resolved by the fix for     CVE-2015-6501, but the fix was incomplete. Puppet     Enterprise 2016.4.0 includes a fix for this     vulnerability. (CVE-2015-5715)

  - A flaw exists in the Puppet Enterprise Console due to     unsafe string processing that allows an authenticated,     remote attacker to execute arbitrary code.

ID	Name	Product	Family	Severity
129764	Puppet Enterprise 2015.x / 2016.x < 2016.4.0 Multiple Vulnerabilities	Nessus	CGI abuses	medium
129754	Puppet Enterprise < 2016.4.0 Multiple Vulnerabilities	Nessus	CGI abuses	high
95392	Puppet Enterprise 2015.x / 2016.x < 2016.4.0 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2016-5715

medium

Tenable Plugins

medium

high

medium