CVE-2014-9355: Infoleak
Published Dec 19, 2014
·Updated
Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint.
Affected Software
1 affected component
puppet Puppet Enterprise<=3.7.0
Event History
Dec 19, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9355?
CVE-2014-9355 is considered a medium severity vulnerability due to its potential impact on sensitive information exposure.
2
How do I fix CVE-2014-9355?
To fix CVE-2014-9355, upgrade Puppet Enterprise to version 3.7.1 or later.
3
What types of users are affected by CVE-2014-9355?
CVE-2014-9355 affects remote authenticated users who have access to certain API endpoints.
4
What information can be accessed through CVE-2014-9355?
CVE-2014-9355 allows access to licensing and certificate signing request information.
5
Is CVE-2014-9355 still a concern in newer versions of Puppet Enterprise?
No, CVE-2014-9355 is not a concern in Puppet Enterprise versions 3.7.1 and above.