CVE Catalog
CVE-2016-2785
CriticalSummary
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
Risk Assessment
The organization may be exposed to unauthorized access to resources, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade Puppet Server to version 2.3.2 or later and Puppet 4.x to version 4.4.2 and Puppet Agent to version 1.4.2 or later to mitigate this vulnerability.
Original NVD description (English source)
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.