Cyber Resilience

CVE-2022-2394

Medium

Published: 19 July 2022

Published
19 July 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0025 48.9th percentile
Risk Priority 8 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-2394 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Perforce Puppet Bolt. Its CVSS base score is 4.1 (Medium).

Operationally, ranked at the 48.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

perforce
puppet bolt
≤ 3.24.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-532

Monitoring directly detects unauthorized disclosure of sensitive information, enabling response to exposures.

addresses: CWE-200 CWE-532

Coordinating audit logging across organizational boundaries reduces the risk of sensitive audit data being exposed to unauthorized actors during transmission.

addresses: CWE-200 CWE-532

A data action map identifies locations where sensitive information may be exposed to unauthorized actors during processing or transfer.

addresses: CWE-200 CWE-532

The control's identification, isolation, alerting, and eradication steps directly limit the impact and exploitation window of unauthorized sensitive information exposure.

addresses: CWE-200 CWE-532

Requiring organization-defined processing conditions on specific PII categories directly reduces the chance that personal data will be exposed to unauthorized actors.

addresses: CWE-200 CWE-532

The assessment process surfaces design decisions that could expose sensitive (including PII) data to unauthorized actors, prompting controls that reduce such exposure.

addresses: CWE-200 CWE-532

Directly prevents exposure of critical organizational information by applying OPSEC processes across the SDLC.

addresses: CWE-200 CWE-532

Filtering output to only permitted content stops unintended disclosure of sensitive information to unauthorized actors.

References