Skip to content
Fencer Vulns
high 7.5

CVE-2020-7943 json

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints.

published 2020-03-11 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28865

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.7%
EPSS 7.7% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known, plus a Nuclei check

Summary

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

Patch / fix

  • puppet puppet_enterprise 2018.1.15, 2019.7.0
  • puppet puppet_server 5.3.13, 6.11.1
  • puppet puppetdb 5.2.15, 6.10.1
  • puppetdb Debian 13, Debian 12 7.11.2-2

debian advisories DEBIAN-CVE-2020-7943

  • tfm satellite capsule 6.8, satellite 6.8 6.1-1.el7sat
  • kobo satellite capsule 6.8, satellite 6.8 0.5.1-1.el7sat
  • pulp satellite capsule 6.8, satellite 6.8 2.21.3-1.el7sat
  • gofer satellite capsule 6.8, satellite 6.8 2.12.5-7.el7sat
  • future satellite capsule 6.8, satellite 6.8 0.16.0-11.el7sat
  • ostree satellite capsule 6.8, satellite 6.8 2017.1-2.atomic.el7
  • foreman satellite capsule 6.8, satellite 6.8 2.1.2.19-1.el7sat
  • katello satellite capsule 6.8, satellite 6.8 3.16.0-1.el7sat

red hat advisories RHSA-2020:4366

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-7943 updated cvss 7.5

puppet: puppet server and puppetDB may leak sensitive information via metrics API

  • Red Hat Satellite 6.8 tfm 6.1-1.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.3-1.el7sat, gofer 2.12.5-7.el7sat, receptor 0.6.3-1.el7ar, future 0.16.0-11.el7sat, +488 more Red Hat Satellite Capsule 6.8 tfm 6.1-1.el7sat, kobo 0.5.1-1.el7sat, pulp 2.21.3-1.el7sat, gofer 2.12.5-7.el7sat, future 0.16.0-11.el7sat, katello 3.16.0-1.el7sat, +232 more
    fixed: vendor fix “Disable the trapperkeeper-metrics /v1 metrics API” RHSA-2020:4366
  • Red Hat OpenStack Platform 10 (Newton) puppet, puppet-server Red Hat OpenStack Platform 13 (Queens) puppet, puppet-server Red Hat OpenStack Platform 15 (Stein) puppet, puppet-server, puppet-headless Red Hat OpenStack Platform 16 (Train) puppet, puppet-server, puppet-headless Red Hat Update Infrastructure 3 for Cloud Providers puppet
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.67% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Puppet Server/PuppetDB - Sensitive Information Disclosure nuclei detection template

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a Puppet Enterprise 2018.1.x stream
  • n/a Puppet Enterprise
  • n/a Puppet Server
  • n/a PuppetDB
  • n/a Resolved in Puppet Enterprise, Puppet Server, PuppetDB

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.