What’s Vulnerable › Vulnerabilities

CVE-2016-2787

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-02-13 · updated 2026-06-17
• Weakness: CWE-284

Description

The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors.

Affected products

• Puppet Enterprise: 2015.3.2
• Puppetlabs Puppet Enterprise: 2015.3

References

• https://puppet.com/security/cve/CVE-2016-2787
• https://puppet.com/security/cve/CVE-2016-2787

Get alerted when CVE-2016-2787 or the next vulnerability affects your stack