Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Puppet_enterprise | Puppet | * | 2021.7.6 (excluding) |
| Puppet_enterprise | Puppet | 2023.0 (including) | 2023.5.0 (excluding) |
Such a scenario is commonly observed when: