Is CVE-2020-7942 actively exploited?

No active exploitation of CVE-2020-7942 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-7942 be exploited remotely?

Yes. CVE-2020-7942 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-7942?

CVE-2020-7942 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2020-7942

MEDIUM

CVE-2020-7942

CWE-295Published: February 19, 2020· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

NVD Source

Technical Analysis

CVE-2020-7942 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.