CVE-2022-2394

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-532

Affected software

Vendor	Product	Versions
Puppet	Bolt	3.24.0

References

https://puppet.com/security/cve/CVE-2022-2394Release Notes, Vendor Advisory
https://puppet.com/security/cve/CVE-2022-2394Release Notes, Vendor Advisory

Timeline

Published: Jul 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-239408.8SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module CVE-2022-239427.5Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information dis CVE-2022-239439.8Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provid CVE-2022-239449.1User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.CVE-2022-239457.5Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.CVE-2022-239467.8A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6 CVE-2022-239477.8A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6 CVE-2022-239487.5A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created CVE-2022-239497.5In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.CVE-2022-23954.8The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform CVE-2022-239507.5In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to pr CVE-2022-239515.5In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.