CVE-2015-7224

9.8 criticalEPSS 1.7%

puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2017-12-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppetlabs-mysql

References

https://puppet.com/security/cve/CVE-2015-7224
https://puppet.com/security/cve/CVE-2015-7224

Check your stack JSON