4.9med
CVE-2017-2293
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to in…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
4.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 53%
Public exploits
0
none known
Summary
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy.
Exploit prediction (EPSS)
0.69% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 4.9 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P |
Affected products
- Puppet Puppet Enterprise
References
- puppet.com /security/cve/cve-2017-2293 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-2293
- NVD: CVE-2017-2293
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.