Medium WID-SEC-2025-2131 1 CVE

Puppet: Schwachstelle ermöglicht Offenlegung von Informationen

Published Sep 24, 2025 · Updated Sep 24, 2025 · de-DE

Vendor: Puppet Product: Puppet Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Puppet ausnutzen, um Informationen offenzulegen.

Product

Puppet ist ein Werkzeug für das System-Management - es soll das Configuration Management zentralisieren und automatisieren.

Vulnerabilities 1

Medium 6.9

CVE-2025-10360

Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterpr…

Perforce Puppet Enterprise

Sep 24, 2025

Revision history

2025-09-24 #1
Initiale Fassung

References

Perforce Portal vom 2025-09-24
https://portal.perforce.com/s/cve/a91PA000001Smp7YAC/insufficiently-protected-credentials-in-puppet-enterprise-20254-and-20255
NIST Vulnerability Database vom 2025-09-24
https://nvd.nist.gov/vuln/detail/CVE-2025-10360