CVE-2012-3864

no score yetEPSS 1.9%

Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2012-08-06
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppet
puppet:puppet_enterprise
puppetlabs:puppet

References

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
http://puppetlabs.com/security/cve/cve-2012-3864/
http://secunia.com/advisories/50014
http://www.debian.org/security/2012/dsa-2511

Check your stack JSON