CVE-2012-5158: Medium severity Puppet Puppet Enterprise vulnerability
Published Mar 14, 2014
·Updated
Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors.
Affected Software
5 affected components
Puppet Puppet Enterprise<=2.6.0
Puppet Puppet Enterprise=2.0.0
Puppet Puppet Enterprise=2.5.1
Puppet Puppet Enterprise=2.5.2
Puppetlabs Puppet=2.5.0
Event History
Mar 14, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-5158?
CVE-2012-5158 is classified as a medium severity vulnerability due to its potential impact on authenticated user sessions.
2
How do I fix CVE-2012-5158?
To fix CVE-2012-5158, you should upgrade Puppet Enterprise to version 2.6.1 or later.
3
What impact does CVE-2012-5158 have on affected systems?
CVE-2012-5158 allows remote authenticated users to retain access even after the session secret changes, potentially leading to unauthorized access.
4
Which versions of Puppet Enterprise are affected by CVE-2012-5158?
Puppet Enterprise versions prior to 2.6.1, including 2.5.0, 2.5.1, 2.5.2, and 2.0.0, are affected by CVE-2012-5158.
5
Is CVE-2012-5158 a remote exploit?
Yes, CVE-2012-5158 can potentially be exploited remotely by authenticated users.