CVE-2018-6515

Published: Jun 11, 2018Modified: Jun 17, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation.

Affected (3)

Products: Puppet: Puppet

1 product

Configuration A

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Puppet Puppet	From 1.10.0 to 1.10.13
Puppet Puppet	From 5.3.0 to 5.3.7
Puppet Puppet	From 5.5.0 to 5.5.2

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://puppet.com/security/cve/CVE-2018-6515

Source: security@puppet.com

Vendor Advisory

https://puppet.com/security/cve/CVE-2018-6515

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.