Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2012-1988

Good to know:

icon

Date: May 29, 2012

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.

Language: Ruby

Severity Score

Related Resources (33)

http://puppetlabs.com/security/cve/cve-2012-1988/
https://web.archive.org/web/20120513213112/http://projects.puppetlabs.com/issues/13518
http://puppetlabs.com/security/cve/cve-2012-1988
http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
https://web.archive.org/web/20121025194938/http://secunia.com/advisories/48743
https://web.archive.org/web/20120816020421/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
https://hermes.opensuse.org/messages/15087408
https://web.archive.org/web/20121025112409/http://secunia.com/advisories/48789
https://web.archive.org/web/20121013181707/http://puppetlabs.com/security/cve/cve-2012-1988
https://web.archive.org/web/20121025113446/http://secunia.com/advisories/48748
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1988.yml
https://nvd.nist.gov/vuln/detail/CVE-2012-1988
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html
https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975
http://projects.puppetlabs.com/issues/13518
http://www.securityfocus.com/bid/52975
http://www.debian.org/security/2012/dsa-2451
https://github.com/puppetlabs/puppet/commit/568ded50ec6cc498ad32ff7f086d9f73b5d24c14
http://www.osvdb.org/81309
https://github.com/puppetlabs/puppet/commit/0d6d29933e613fe177e9235415919a5428db67bc
https://web.archive.org/web/20121025194830/http://secunia.com/advisories/49136
http://secunia.com/advisories/48789
https://github.com/puppetlabs/puppet
https://web.archive.org/web/20121031092646/http://www.securityfocus.com/bid/52975
http://secunia.com/advisories/48748
https://hermes.opensuse.org/messages/14523305
https://exchange.xforce.ibmcloud.com/vulnerabilities/74796
http://ubuntu.com/usn/usn-1419-1
http://secunia.com/advisories/49136
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html
http://secunia.com/advisories/48743
https://www.mend.io/vulnerability-database/CVE-2012-1988

Severity Score

Weakness Type (CWE)

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-77

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78

Top Fix

icon

Upgrade Version

Upgrade to version puppet - 2.6.15;puppet - 2.7.13

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): SINGLE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us