CVE-2015-7224

Critical

Published: 21/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Versions of puppetlabs-mysql from 3.1.0 to 3.6.0 allow remote attackers to bypass authentication by creating a database account without a password when the 'mysql_user' user parameter contains a host with a netmask.

Risk Assessment

Attackers can gain access to the database without authorization, potentially leading to unauthorized access to sensitive data.

Recommendation

It is recommended to upgrade to the latest version of puppetlabs-mysql to mitigate this vulnerability and implement strong password policies for user accounts.

Original NVD description (English source)

puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.