VULNERABILITY INTELLIGENCE

CVE-2016-2785

CVSS score9.8 CRITICAL

EPSS probability2.89%

CISA KEVNot currently listed

Published2016-06-10

Last modified2026-06-17

Description

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.