Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2011-10-27T20:00:00
Updated: 2017-12-08T10:57:01
Reserved: 2011-09-27T00:00:00
Link: CVE-2011-3848
JSON object: View
NVD Information
Status : Modified
Published: 2011-10-27T20:55:01.230
Modified: 2019-07-10T14:13:50.833
Link: CVE-2011-3848
JSON object: View
Redhat Information
No data.
CWE