{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-29T14:42:22.275","vulnerabilities":[{"cve":{"id":"CVE-2011-3848","sourceIdentifier":"cve@mitre.org","published":"2011-10-27T20:55:01.230","lastModified":"2026-06-16T23:34:01.770","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25."},{"lang":"es","value":"Vulnerabilidad de salto de directorio en Puppet v2.6.x antes de v2.6.10 y v2.7.x antes de v2.7.4, permite a atacantes remotos escribir Certificate Signing Request (CSR) X.509 en ubicaciones de su elección a través de (1) un parámetro clave de doble codificación en la URI en v2.7.x, (2) el CN en el Subject de un CSR en v2.6 y v0.25."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*","matchCriteriaId":"9BEF50EE-4E4B-4641-BA34-B5024F1EF683"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*","matchCriteriaId":"1CC72248-FD33-4CA0-A16E-0A174A864257"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*","matchCriteriaId":"7CEFB16E-261F-4B81-BCBE-536CAD2EC44B"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*","matchCriteriaId":"652D28FC-7133-4C5F-95D9-3468548465B5"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*","matchCriteriaId":"AEEEE59D-BC0E-4107-B55D-9B182825E557"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*","matchCriteriaId":"B4ED400E-48F7-475B-A87C-A14EC63DD93D"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*","matchCriteriaId":"D827D4C2-7438-4EDD-9025-38D46CD5153C"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*","matchCriteriaId":"E73C341A-6C07-4820-B1D3-4616B634F380"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*","matchCriteriaId":"61381D4C-972F-4979-84D2-793E4C60E23E"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*","matchCriteriaId":"7D8C2A71-0277-4426-8627-D6FD275EFC62"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*","matchCriteriaId":"BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*","matchCriteriaId":"FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*","matchCriteriaId":"1E5192CB-094F-469E-A644-2255C4F44804"},{"vulnerable":true,"criteria":"cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*","matchCriteriaId":"D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0"}]}]}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html","source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/46628","source":"cve@mitre.org","tags":["Vendor Advisory"]},{"url":"http://www.debian.org/security/2011/dsa-2314","source":"cve@mitre.org"},{"url":"http://www.ubuntu.com/usn/USN-1217-1","source":"cve@mitre.org"},{"url":"https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://puppet.com/security/cve/cve-2011-3848","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/46628","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://www.debian.org/security/2011/dsa-2314","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-1217-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://puppet.com/security/cve/cve-2011-3848","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}