{"id":"CVE-2016-2785","details":"Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.","aliases":["GHSA-pqj5-7r86-64fv"],"modified":"2026-07-08T05:47:45.873314309Z","published":"2016-06-10T15:59:00.140Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"puppet:puppet","cpes":["cpe:2.3:a:puppet:puppet:4.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2"},{"type":"ADVISORY","url":"https://puppet.com/security/cve/cve-2016-2785"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201606-02"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppet","events":[{"introduced":"75c303d554628a988ac0b361582a9c974d4475e8"},{"last_affected":"37d1d457b38d29c39c689ddd484285c7821a7194"}],"database_specific":{"cpe":["cpe:2.3:a:puppet:puppet:4.0.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.0.0:rc2:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.0.0:rc3:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.2.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.2.1:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.2.2:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.2.3:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.3.1:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.3.2:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.4.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet:4.4.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"introduced":"4.0.0-rc1"},{"last_affected":"4.0.0-rc1"},{"introduced":"4.0.0-rc2"},{"last_affected":"4.0.0-rc2"},{"introduced":"4.0.0-rc3"},{"last_affected":"4.0.0-rc3"},{"introduced":"4.1.0"},{"last_affected":"4.1.0"},{"introduced":"4.2.0"},{"last_affected":"4.2.0"},{"introduced":"4.2.1"},{"last_affected":"4.2.1"},{"introduced":"4.2.2"},{"last_affected":"4.2.2"},{"introduced":"4.2.3"},{"last_affected":"4.2.3"},{"introduced":"4.3.0"},{"last_affected":"4.3.0"},{"introduced":"4.3.1"},{"last_affected":"4.3.1"},{"introduced":"4.3.2"},{"last_affected":"4.3.2"},{"introduced":"4.4.0"},{"last_affected":"4.4.0"},{"introduced":"4.4.1"},{"last_affected":"4.4.1"}],"source":"CPE_STRING"}}],"versions":["4.0.0","4.0.0-rc1","4.0.0-rc2","4.0.0-rc3","4.1.0","4.2.0","4.2.1","4.2.2","4.2.3","4.3.0","4.3.1","4.3.2","4.4.0","4.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2785.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppet-agent","events":[{"introduced":"1fc76b7039d540aa0ccb6af199a1ccf046649e70"},{"last_affected":"1fc76b7039d540aa0ccb6af199a1ccf046649e70"}],"database_specific":{"cpe":"cpe:2.3:a:puppet:puppet_agent:1.4.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.4.1"},{"last_affected":"1.4.1"}],"source":"CPE_STRING"}}],"versions":["1.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2785.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppetlabs-puppet_agent","events":[{"introduced":"459e3d2f29a785919bf89772ce3ffb6d66336a6e"},{"last_affected":"459e3d2f29a785919bf89772ce3ffb6d66336a6e"}],"database_specific":{"source":"CPE_STRING","cpe":"cpe:2.3:a:puppet:puppet_agent:1.4.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.4.1"},{"last_affected":"1.4.1"}]}}],"versions":["1.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2785.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppetserver","events":[{"introduced":"612d532124560881e63aa35a0f56b50a67f06e82"},{"last_affected":"0b8199d9f35d5c17c241bad7d3f0c34d7b929270"}],"database_specific":{"cpe":["cpe:2.3:a:puppet:puppet_server:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_server:2.1.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_server:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_server:2.1.2:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_server:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_server:2.3.0:*:*:*:*:*:*:*","cpe:2.3:a:puppet:puppet_server:2.3.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"introduced":"2.1.0"},{"last_affected":"2.1.0"},{"introduced":"2.1.1"},{"last_affected":"2.1.1"},{"introduced":"2.1.2"},{"last_affected":"2.1.2"},{"introduced":"2.2.0"},{"last_affected":"2.2.0"},{"introduced":"2.3.0"},{"last_affected":"2.3.0"},{"introduced":"2.3.1"},{"last_affected":"2.3.1"}],"source":"CPE_STRING"}}],"versions":["2.0.0","2.1.0","2.1.1","2.1.2","2.2.0","2.3.0","2.3.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2785.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}