CVE-2016-2786

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-03-14T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-06-10T14:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://puppet.com/security/cve/CVE-2016-2786"}, {"name": "GLSA-201606-02", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201606-02"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-2786", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://puppet.com/security/cve/CVE-2016-2786", "refsource": "CONFIRM", "url": "https://puppet.com/security/cve/CVE-2016-2786"}, {"name": "GLSA-201606-02", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201606-02"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:32:20.981Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://puppet.com/security/cve/CVE-2016-2786"}, {"name": "GLSA-201606-02", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201606-02"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-2786", "datePublished": "2016-06-10T15:00:00.000Z", "dateReserved": "2016-02-29T00:00:00.000Z", "dateUpdated": "2024-08-05T23:32:20.981Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_agent:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "6EB387B5-667B-4CA8-BAFC-465F2E4A9485", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_agent:1.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "E61A7AF3-5B7E-44BA-BD59-6C392505748D", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_agent:1.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "48949FBD-A81F-4CFB-806F-A845A41656E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_agent:1.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "C992FC14-21DB-4E3B-AA51-F15383A55C73", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_agent:1.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "70BEDC55-CCDB-4B86-A4B1-07EA5603A59C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2015.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "364465AC-E8C6-4245-8F33-CD4EFDFA3D2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2015.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "B18FA0E7-381A-4831-9E2A-DE94D5FCDA83", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate."}, {"lang": "es", "value": "El componente pxp-agent en Puppet Enterprise 2015.3.x en versiones anteriores a 2015.3.3 y Puppet Agent 1.3.x en versiones anteriores a 1.3.6 no valida adecuadamente certificados de servidor, lo que podr\u00eda permitir a atacantes remotos espiar brokers y ejecutar comandos arbitrarios a trav\u00e9s de un certificado manipulado."}], "id": "CVE-2016-2786", "lastModified": "2026-06-17T00:44:23.897", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-06-10T15:59:01.343", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://puppet.com/security/cve/CVE-2016-2786"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201606-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://puppet.com/security/cve/CVE-2016-2786"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201606-02"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}