CVE-2014-3251

2014-08-1223:55:03

CWE-362

[email protected]

web.nvd.nist.gov

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

AI Score

Confidence

Low

EPSS

Percentile

5.1%

JSON

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

Affected configurations

Nvd

Node

puppetpuppet_enterpriseRange≤3.2.0

puppetlabsmcollectiveMatch-

VendorProductVersionCPE
puppetpuppet_enterprise*cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*
puppetlabsmcollective-cpe:2.3:a:puppetlabs:mcollective:-:*:*:*:*:*:*:*