VULNERABILITY INTELLIGENCE

CVE-2012-3864

CVSS score4 MEDIUM
EPSS probability1.91%
CISA KEVNot currently listed
Published2012-08-06
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:P/I:N/A:N

Description

Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references