Sign inStart freeBook a demo

Puppet Server vulnerabilitiesRanked by how likely they are to be used.

Product113 versions
The short answer

Puppet Server is made by Puppet. We track 7 published vulnerabilities in it, across 113 versions. None of them is on the list of flaws known to be exploited today. If you run Puppet Server, keep it on a version the vendor still supports.

See the riskiest flaws

We keep watching the known-exploited list.

Known exploited

Which Puppet Server vulnerabilities are being exploited?

This is the list that matters most: flaws criminals are using now.

None of Puppet Server's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.

Exploit likelihood

Which Puppet Server flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.

50% or more10% to 49%Under 10%
  1. 8.8%
    CVE-2020-7943High

    Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints.

    CVSS7.5Published11 Mar 2020
  2. 2.9%
    CVE-2016-2785Critical

    Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL...

    CVSS9.8Published10 Jun 2016
  3. 1.4%
    CVE-2021-27023Critical

    A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host.

    CVSS9.8Published18 Nov 2021
  4. 0.6%
    CVE-2018-11751Medium

    Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL.

    CVSS5.4Published16 Dec 2019
  5. 0.5%
    CVE-2023-5255High

    For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.

    CVSS7.5Published3 Oct 2023
  6. 0.4%
    CVE-2023-1894Medium

    A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation.

    CVSS5.3Published4 May 2023
  7. 0.2%
    CVE-2014-7170Low

    Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

    CVSS1.9Published17 Dec 2014
Precursor Intelligence

Running Puppet Server? We'll keep checking.

Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.

  1. Tell us what you runPick your software from a list, or let us work it out from your website.
  2. We match it to every flawOver 400,000 published flaws, checked against your list.
  3. Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
  4. Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Start free →Book a demo

Free plan, no card needed. Nothing to install.

FAQ

Common questions, answered plainly.

Something else? Talk to the team →

We track 7 published vulnerabilities listed under the name Puppet Server, across 113 versions.

None of Puppet Server's vulnerabilities is on the list of flaws known to be exploited today.

Create a Precursor Intelligence account and track Puppet Server. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.

Keep exploring