Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qdsk-m9ye-z3a4
Vulnerability ID VCID-qdsk-m9ye-z3a4
Aliases CVE-2021-27023
GHSA-93j5-g845-9wqp
Summary Unsafe HTTP Redirect in Puppet Agent and Puppet Server A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27023.json
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
epss 0.00397 https://api.first.org/data/v1/epss?cve=CVE-2021-27023
cvssv3.1 7.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-93j5-g845-9wqp
cvssv3.1 6.5 https://github.com/puppetlabs/puppet
generic_textual MODERATE https://github.com/puppetlabs/puppet
cvssv3.1 6.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2021-27023.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2021-27023.yml
cvssv3.1 6.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2021-27023
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-27023
cvssv3 6.5 https://puppet.com/security/cve/CVE-2021-27023
cvssv3.1 6.5 https://puppet.com/security/cve/CVE-2021-27023
generic_textual MODERATE https://puppet.com/security/cve/CVE-2021-27023
archlinux Medium https://security.archlinux.org/AVG-2541
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27023.json
https://api.first.org/data/v1/epss?cve=CVE-2021-27023
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27023
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/puppetlabs/puppet
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2021-27023.yml
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
2023859 https://bugzilla.redhat.com/show_bug.cgi?id=2023859
AVG-2541 https://security.archlinux.org/AVG-2541
CVE-2021-27023 https://nvd.nist.gov/vuln/detail/CVE-2021-27023
CVE-2021-27023 https://puppet.com/security/cve/CVE-2021-27023
GHSA-93j5-g845-9wqp https://github.com/advisories/GHSA-93j5-g845-9wqp
RHSA-2022:1478 https://access.redhat.com/errata/RHSA-2022:1478
RHSA-2022:1708 https://access.redhat.com/errata/RHSA-2022:1708
RHSA-2022:4866 https://access.redhat.com/errata/RHSA-2022:4866
RHSA-2022:4867 https://access.redhat.com/errata/RHSA-2022:4867
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-27023.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/puppetlabs/puppet
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2021-27023.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-27023
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://puppet.com/security/cve/CVE-2021-27023
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.60441
EPSS Score 0.00397
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:07.680090+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/puppet/CVE-2021-27023.yml 38.0.0