Vulnerability Database

310,449

Total vulnerabilities in the database

CVE-2016-2785

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

  • Published: Jun 10, 2016
  • Updated: Nov 9, 2025
  • CVE: CVE-2016-2785
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
puppet / puppet 4.0.0 4.0.0.x
puppet / puppet 4.0.0-rc1 4.0.0-rc1.x
puppet / puppet 4.0.0-rc2 4.0.0-rc2.x
puppet / puppet 4.0.0-rc3 4.0.0-rc3.x
puppet / puppet 4.1.0 4.1.0.x
puppet / puppet 4.2.0 4.2.0.x
puppet / puppet 4.2.1 4.2.1.x
puppet / puppet 4.2.2 4.2.2.x
puppet / puppet 4.2.3 4.2.3.x
puppet / puppet 4.3.0 4.3.0.x
puppet / puppet 4.3.1 4.3.1.x
puppet / puppet 4.3.2 4.3.2.x
puppet / puppet 4.4.0 4.4.0.x
puppet / puppet 4.4.1 4.4.1.x
puppet / puppet_server 2.0.0 2.0.0.x
puppet / puppet_server 2.1.0 2.1.0.x
puppet / puppet_server 2.1.1 2.1.1.x
puppet / puppet_server 2.1.2 2.1.2.x
puppet / puppet_server 2.2.0 2.2.0.x
puppet / puppet_server 2.3.0 2.3.0.x
puppet / puppet_server 2.3.1 2.3.1.x
puppet / puppet_agent 1.4.1 1.4.1.x