CVE-2019-10694

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	Puppet Enterprise	Puppet Enterprise 2019.x prior to 2019.0.3, Puppet Enterprise 2018.x prior to 2018.1.9

References

https://puppet.com/security/cve/CVE-2019-10694Vendor Advisory
https://puppet.com/security/cve/CVE-2019-10694Vendor Advisory

Timeline

Published: Dec 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-106956.5When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password CVE-2019-10705.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2019-107057.5Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data CVE-2019-107066.3Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC di CVE-2019-107079.8MKCMS V5.0 has SQL injection via the bplay.php play parameter.CVE-2019-107089.8S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.CVE-2019-107099.8AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS CVE-2019-10715.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information CVE-2019-107108.8Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to rece CVE-2019-107117.5Incorrect access control in the RTSP stream and web portal on all IP cameras based on Hisilicon Hi3510 firmware (until Webware version V1.0.CVE-2019-107129.8The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and S CVE-2019-107146.5LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.