The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPuppet Enterprise
APPPuppet2018.1.0 – 2018.1.9 (bez)2019.0 – 2019.0.3 (bez)
Related vulnerabilities
A privilege escalation allowing remote code execution was discovered in the orchestration service.
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when fol...
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via p...
The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razo...
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arb...