CVE-2021-27019 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
puppet	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 43%

Vendor	Product	Version
puppet	puppet_enterprise	𝑥 < 2019.8.6
puppet	puppetdb	6.0.0 ≤ 𝑥 < 6.16.1
puppet	puppetdb	7.0.0 ≤ 𝑥 < 7.3.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

puppetdb

bookworm	7.12.1-3 fixed
buster	no-dsa
sid	8.4.1-2 fixed
trixie	8.4.1-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

puppetdb

noble	needs-triage
mantic	ignored
lunar	ignored
kinetic	ignored
jammy	needs-triage
impish	ignored
hirsute	dne
focal	dne
bionic	dne
xenial	ignored
trusty	dne

Common Weakness Enumeration

CWE-532 - Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References

https://puppet.com/security/cve/CVE-2021-27019

https://puppet.com/security/cve/CVE-2021-27019