Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-7943
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
缺省权限不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
Puppet和PuppetDB 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Puppet和Puppet Server都是美国Puppet（Puppet）实验室的产品。Puppet是一套基于客户端/服务器（C/S）架构的配置管理工具，它可用于管理配置文件、用户、cron任务、软件包、系统服务等。Puppet Enterprise是Puppet的企业版。PuppetDB是Puppet的下一代开源存储服务，它可用于管理所有平台生成的数据存储和检索。Puppet Server是一款用于将配置从主服务器推送到其他服务器的软件。 Puppet Enterprise、Puppet Server
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
-Puppet Enterprise 2018.1.x stream prior to 2018.1.13 -
-Puppet Enterprise prior to 2019.5.0 -
-Puppet Server prior to 6.9.2 -
-PuppetDB prior to 6.9.1 -
-Resolved in Puppet Enterprise, Puppet Server, PuppetDB Puppet Enterprise 2018.1.13 and 2019.5.0 -
II. Public POCs for CVE-2020-7943
#POC DescriptionSource LinkShenlong Link
1Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints, which may contain sensitive information when left exposed.https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-7943.yamlPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2020-7943
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same vendor: n/a
Same weakness: CWE-276
V. Comments for CVE-2020-7943

No comments yet

Leave a comment