| Package | Affected versions | Patched versions |
|---|---|---|
| puppet enterprise | ≥ 2015.2.0, ≤ 2015.3.3≥ 2016.1.1, ≤ 2016.4.0 |
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free