[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpzdliiRHarsDRXOcqCaZvYsmyEDgAyhk7mBCVH_9cX4":3,"g5a-risk:CVE-2020-7943":136},{"success":4,"data":5,"meta":134},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":26,"epssTimeSeries":40,"severity":41,"affectedProducts":42,"affectedProductsCount":54,"references":55,"referencesCount":61,"weaknesses":62,"weaknessesCount":61,"isActivelyExploited":71,"cisaInfo":26,"otxData":26,"relatedBlogPosts":72,"seoMetadata":73,"configurations":98,"relatedVendorCves":125,"notableEvents":126},"CVE-2020-7943","What is CVE-2020-7943?","Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics \u002Fv1 metrics API and only allows \u002Fv2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13","Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like ho...","2020-03-11T23:15:11.98","2022-01-24T16:46:00.87",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":29,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,[30],{"Source":17,"Type":18,"CVSSData":31,"BaseSeverity":36,"ExploitabilityScore":37,"ImpactScore":38,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":32,"VectorString":33,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":34,"IntegrityImpact":23,"AvailabilityImpact":23,"BaseScore":35,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:P\u002FI:N\u002FA:N","PARTIAL",5,"MEDIUM",10,2.9,0.0881,[39,39,39,39,39,39,39],"High",[43,48,51],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"puppet","puppet_enterprise","*","cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",{"vendor":44,"product":49,"version":46,"criteria":50,"vulnerable":4},"puppet_server","cpe:2.3:a:puppet:puppet_server:*:*:*:*:*:*:*:*",{"vendor":44,"product":52,"version":46,"criteria":53,"vulnerable":4},"puppetdb","cpe:2.3:a:puppet:puppetdb:*:*:*:*:*:*:*:*",3,[56],{"url":57,"source":58,"tags":59},"https:\u002F\u002Fpuppet.com\u002Fsecurity\u002Fcve\u002FCVE-2020-7943\u002F","Puppet",[60],"Vendor Advisory",1,[63],{"id":64,"name":65,"description":66,"extendedDescription":67,"status":68,"abstraction":69,"structure":70},"CWE-276","Incorrect Default Permissions","During installation, installed file permissions are set to allow anyone to modify those files.","","Draft","Base","Simple",false,[],{"title":74,"metaDescription":75,"keywords":76,"canonicalUrl":77,"structuredData":78},"What is CVE-2020-7943? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-7943, a high severity cyber security vulnerability from 2020. Puppet Server and PuppetDB provide useful performance and de...","CVE-2020-7943, CVE-2020-7943 vulnerability, CVE-2020-7943 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, puppet security, puppet_enterprise vulnerability, puppet_server vulnerability, puppetdb vulnerability","\u002Fwhat-is\u002Fcve-2020-7943",{"@context":79,"@type":80,"headline":74,"description":75,"datePublished":10,"dateModified":11,"author":81,"publisher":85,"about":89,"mainEntityOfPage":93,"articleSection":96,"keywords":97},"https:\u002F\u002Fschema.org","TechArticle",{"@type":82,"name":83,"url":84},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":82,"name":83,"url":84,"logo":86},{"@type":87,"url":88},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":90,"name":6,"description":91,"additionalType":92},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":94,"@id":95},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-7943","Cybersecurity","CVE-2020-7943, CVE-2020-7943 vulnerability, CVE-2020-7943 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[99],{"Operator":26,"Negate":26,"Nodes":100},[101],{"Operator":102,"Negate":26,"CPEMatch":103},"OR",[104,108,112,115,119,122],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":105,"VersionStartExcluding":26,"VersionStartIncluding":106,"VersionEndExcluding":107,"VersionEndIncluding":26},"1F3D810B-9BB0-4914-A592-62FBA9B10DF2","2018.1.0","2018.1.15",{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":109,"VersionStartExcluding":26,"VersionStartIncluding":110,"VersionEndExcluding":111,"VersionEndIncluding":26},"1B4658B0-FB22-46B4-9486-FED7310A8588","2019.0","2019.7.0",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":113,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":114,"VersionEndIncluding":26},"61E3FE38-517D-4A13-B8B1-026631C622FB","5.3.13",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":116,"VersionStartExcluding":26,"VersionStartIncluding":117,"VersionEndExcluding":118,"VersionEndIncluding":26},"1B678275-E7F9-4E7E-A6AD-931DD578E1EA","6.0.0","6.11.1",{"Vulnerable":4,"Criteria":53,"MatchCriteriaID":120,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":121,"VersionEndIncluding":26},"60BB4CC2-35A3-453C-B80F-6F13E1C2FCE1","5.2.15",{"Vulnerable":4,"Criteria":53,"MatchCriteriaID":123,"VersionStartExcluding":26,"VersionStartIncluding":117,"VersionEndExcluding":124,"VersionEndIncluding":26},"D74AC81C-DE98-49F2-AE91-041AEE6B2C30","6.10.1",[],[127],{"id":128,"eventType":129,"eventTime":130,"details":131,"label":132,"color":133},"11f4ab46-ecd1-4bdb-95ea-1d695fb72d46","LOW_EPSS_DELTA","2026-06-16T04:05:46.962809+00:00","Daily EPSS score decreased by 0.575 on 2023-12-30","EPSS Score Decreased","green",{"lastModified":11,"cacheTime":135,"version":32},1792256962513,{"score":137,"band":138,"action":139,"scoredAt":140},57,"Medium","Plan remediation","2026-10-16T06:48:01.905906+00:00"]