Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a speci

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• puppet puppet1.10.0 and later · before 1.10.13
• puppet puppet5.3.0 and later · before 5.3.7
• puppet puppet5.5.0 and later · before 5.5.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (puppet). Independent of NVD's CPE analysis and usually ahead of it.

• Puppet Puppet Agent

  • Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2affected

Other highest-scoring records for the same primary product.

• CVE-2016-2785Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to
  40Plan
• CVE-2013-1640The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1
  37Monitor
• CVE-2021-27021A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query
  35Monitor
• CVE-2018-6513Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, P
  35Monitor
• CVE-2017-2295Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified
  33Monitor
• CVE-2018-6514In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerab
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.