8.8high
CVE-2016-5716
The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code e…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 78%
Public exploits
0
none known
Summary
The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.
Exploit prediction (EPSS)
1.77% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- Puppet Puppet Enterprise
Classification
- Weakness
- CWE-134 Use of Externally-Controlled Format String
References
- puppet.com /security/cve/pe-console-oct-2016 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2016-5716
- NVD: CVE-2016-5716
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.