Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1,…

Published 8 y ago 2018-06-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.1%

percentile 66%

Public exploits

none known

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths.

Exploit prediction (EPSS)

1.12% probability of exploitation in the next 30 days, higher than 66% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.5	`AV:N/AC:L/Au:S/C:P/I:P/A:P`

Affected products

Puppet Puppet Enterprise and Puppet Agent

Classification

Weakness

CWE-426 Untrusted Search Path

References

puppet.com /security/cve/CVE-2018-6513 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-6513
NVD: CVE-2018-6513

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.