Vulnerability · Published Jul 19, 2022 · Assigned by puppet
CVE-2022-2394Sensitive Parameter Exposure in Puppet Bolt prior to 3.24
Medium 4.1
In plain English
A medium-severity information exposure in Bolt from Puppet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
References
- https://puppet.com/security/cve/CVE-2022-2394 x_refsource_MISC