CVE Feed

    Dashboard / CVE / CVE-2016-5714

    CVE-2016-5714

    Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability."

    Published:Oct 18, 2017
    Last Modified:Apr 20, 2025
    EPS:Oct 18, 2017
    EPSS Score:0.0101
    CVSS Score:7.2

    Affected Products

    Vendor
    Puppet
    Product
    Puppet Agent
    Vendor
    Puppet
    Product
    Puppet Enterprise

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2021-27023 (CVSS 9.8) — A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when fol…
    CVE-2021-27025 (CVSS 6.5) — A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable…
    CVE-2021-27017 (CVSS 6.6) — Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied d…
    CVE-2020-7942 (CVSS 6.5) — Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in…
    CVE-2016-5713 (CVSS 9.8) — Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that p…
    CVE-2016-2786 (CVSS 9.8) — The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does…
    CVE-2016-2785 (CVSS 9.8) — Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 m…
    CVE-2015-1855 (CVSS 5.9) — verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High