CVE-2015-4100

{"id": "CVE-2015-4100", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "published": "2017-12-21T15:29:00.237", "references": [{"url": "https://puppet.com/security/cve/CVE-2015-4100", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://puppet.com/security/cve/CVE-2015-4100", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master, aka a \"Certificate Authority Reverse Proxy Vulnerability.\""}, {"lang": "es", "value": "Puppet Enterprise 3.7.x y 3.8.0 podr\u00eda permitir que los usuarios autenticados remotos gestionen certificados para nodos arbitrarios utilizando un certificado de cliente considerado como fiable por el maestro. Esta vulnerabilidad tambi\u00e9n se conoce como \"Certificate Authority Reverse Proxy Vulnerability\"."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3C0546D-3FF4-461A-B6C4-3C1586DFA79E", "versionEndIncluding": "3.7.2", "versionStartIncluding": "3.7.0"}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0115B62-078B-43C7-AD21-45C12B8298FC"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}