CVE-2012-0891: XSS
First published: Fri Mar 14 2014(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Puppet Puppet Dashboard | =1.0.0 | |
| Puppet Puppet Dashboard | =1.0.3 | |
| Puppet Puppet Dashboard | =1.0.4 | |
| Puppet Puppet Dashboard | =1.1.0 | |
| Puppet Puppet Dashboard | =1.1.1 | |
| Puppet Puppet Dashboard | =1.2.0 | |
| Puppet Puppet Dashboard | =1.2.1 | |
| Puppet Puppet Dashboard | =1.2.2 | |
| Puppet Puppet Dashboard | =1.2.3 | |
| Puppet Puppet Dashboard | =1.2.4 | |
| Puppet Enterprise | =1.0 | |
| Puppet Enterprise | =1.1 | |
| Puppet Enterprise | =1.2.0 | |
| Puppet Enterprise | =2.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-0891?
CVE-2012-0891 has a medium severity rating due to its potential for allowing cross-site scripting attacks.
How do I fix CVE-2012-0891?
To fix CVE-2012-0891, upgrade Puppet Dashboard and Puppet Enterprise to version 1.2.5 or later.
What types of attacks can CVE-2012-0891 facilitate?
CVE-2012-0891 can facilitate cross-site scripting (XSS) attacks, allowing attackers to inject arbitrary scripts or HTML.
Which versions of Puppet Dashboard are affected by CVE-2012-0891?
Puppet Dashboard versions 1.0 through 1.2.4 are affected by CVE-2012-0891.
Which versions of Puppet Enterprise are vulnerable to CVE-2012-0891?
Puppet Enterprise versions 1.0 through 1.2.4 are vulnerable to CVE-2012-0891.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/puppet
- canonical/puppet puppet dashboard
- version/puppet puppet dashboard/1.0.0
- version/puppet puppet dashboard/1.0.3
- version/puppet puppet dashboard/1.0.4
- version/puppet puppet dashboard/1.1.0
- version/puppet puppet dashboard/1.1.1
- version/puppet puppet dashboard/1.2.0
- version/puppet puppet dashboard/1.2.1
- version/puppet puppet dashboard/1.2.2
- version/puppet puppet dashboard/1.2.3
- version/puppet puppet dashboard/1.2.4
- canonical/puppet enterprise
- version/puppet enterprise/1.0
- version/puppet enterprise/1.1
- version/puppet enterprise/1.2.0
- version/puppet enterprise/2.0.0