VulnerabilityPublished 5 Jun 2024Updated 21 Nov 2025

CVE-2024-3716: Information Exposure

Source CVE Database V5

Not known to be exploited · CVSS 6.2 Medium.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score

6.2Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 5 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate this vulnerability, organizations should avoid passing passwords or other sensitive information via command-line parameters. Instead, use environment variables, configuration files with strict permissions, or secure input prompts that do not expose secrets in process listings. Review and update deployment scripts or automation tools invoking puppet-candlepin to eliminate the use of the --password parameter on the command line. Restrict local user access to trusted personnel only and enforce the principle of least privilege to minimize the risk of unauthorized local users viewing process information. Monitor systems for unusual local access or process listing commands. Stay alert for official patches or updates from foreman-installer maintainers and apply them promptly once available. Consider using system-level protections such as process hiding or kernel-level security modules to limit process information exposure if applicable.

Description

A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.

Impact

The primary impact of this vulnerability is the exposure of sensitive passwords to unauthorized local users. If an attacker gains local access, they can easily retrieve the password from the process list, potentially leading to further unauthorized access or lateral movement within the environment. This compromises confidentiality but does not directly affect system integrity or availability. The risk is heightened in multi-tenant or shared environments where multiple users have local access. Organizations relying on foreman-installer and puppet-candlepin for configuration management or subscription management may face credential theft, which could cascade into broader security breaches if the exposed password grants access to critical systems or services. Since exploitation requires local access, remote attackers are less likely to benefit directly from this flaw unless they can first compromise a local account.

Summary

The vulnerability CVE-2024-3716 involves the foreman-installer tool, specifically when the puppet-candlepin component is executed with the --password parameter. The issue arises because the password is passed as a command-line argument, which is visible in the process list (e.g., via commands like 'ps' on Unix/Linux systems). This exposure allows any local user with the ability to view running processes to read the password in cleartext, leading to unauthorized disclosure of sensitive credentials. The vulnerability does not require any privileges or user interaction to exploit, but it does require local access to the affected system. The CVSS 3.1 base score is 6.2, reflecting a medium severity primarily due to the confidentiality impact. The flaw does not affect the integrity or availability of the system. No patches or fixes are currently linked in the provided data, and no known exploits have been reported in the wild. This vulnerability highlights the risk of passing sensitive information via command-line parameters, which is a common security anti-pattern. Organizations using foreman-installer with puppet-candlepin should audit their usage and consider alternative secure methods for handling passwords.

References

Community reviews

Loading reviews…