PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5715 Puppet CVE debrief

CVE-2016-5715 is an open redirect vulnerability in the Puppet Enterprise Console. An attacker could craft a redirect parameter containing a //-prefixed domain and send a user to an arbitrary website, which can support phishing and credential theft attempts. NVD rates the issue as medium severity (CVSS 6.1) and notes it was caused by an incomplete fix for CVE-2015-6501.

Vendor
Puppet
Product
Puppet Enterprise
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-12
Original CVE updated
2026-05-13
Advisory published
2017-01-12
Advisory updated
2026-05-13

Who should care

Administrators and security teams running Puppet Enterprise Console in affected releases, especially 2015.2.0 through 2015.3.3 and 2016.1.1 through 2016.4.0, should treat this as a user-facing phishing risk. Anyone relying on the Console for authentication or trusted navigation should review exposure.

Technical summary

The vulnerability is a CWE-601 open redirect in the Puppet Enterprise Console. NVD lists affected versions as Puppet Enterprise 2015.2.0 through 2015.3.3 and 2016.1.1 through 2016.4.0. The issue is reachable over the network and requires user interaction, with confidentiality and integrity impact limited and no availability impact. The NVD description says the flaw exists because of an incomplete fix for CVE-2015-6501.

Defensive priority

Medium priority. The issue does not indicate code execution, but it can be used to support convincing phishing and redirect users away from the trusted Puppet interface. Patch priority should be elevated if the Console is exposed to end users or used in workflows where redirected links are trusted.

Recommended defensive actions

  • Upgrade Puppet Enterprise to a fixed release at or above 2016.4.0, or otherwise move off affected 2015.x/2016.x versions identified by NVD.
  • Review Console links and any application logic that accepts redirect parameters for open redirect patterns.
  • Warn users not to trust unexpected Puppet Console redirects, especially URLs using // followed by a domain.
  • If immediate patching is not possible, reduce exposure of the Console to untrusted users and monitor for suspicious redirect usage.
  • Validate that protections intended to address CVE-2015-6501 are fully in place and not bypassable by crafted redirect inputs.

Evidence notes

Source evidence comes from the NVD CVE record and the published references it lists, including the Puppet vendor advisory URL. The NVD entry identifies the weakness as CWE-601 and provides the affected version ranges and CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The description explicitly states the flaw is an incomplete fix for CVE-2015-6501.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5715 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5715

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5715 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5715

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.