1. CVE-Search
  2. CVE-2016-5715
ID CVE-2016-5715
Summary Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501.
References
Vulnerable Configurations
  • cpe:2.3:a:puppet:puppet_enterprise:2015.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2015.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2015.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2015.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2015.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2015.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2015.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2015.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2015.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2015.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2015.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2015.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2015.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2015.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2015.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2015.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2016.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2016.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2016.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2016.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2016.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2016.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2016.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2016.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:puppet:puppet_enterprise:2016.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:puppet:puppet_enterprise:2016.4.0:*:*:*:*:*:*:*
CVSS
Base: 5.8 (as of 24-01-2022 - 16:46)
Impact:
Exploitability:
CWE CWE-601
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:N
refmap via4
bid 93846
bugtraq 20161022 Puppet Enterprise Web Interface Authentication Redirect
confirm https://puppet.com/security/cve/cve-2016-5715
misc
Last major update 24-01-2022 - 16:46
Published 12-01-2017 - 23:59
Last modified 24-01-2022 - 16:46
Back to Top