CVE-2018-6516

Published: Jun 14, 2018Modified: Jun 17, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation.

Affected (3)

Products: Puppet: Puppet Enterprise Client Tools

Puppet

1 product

Puppet Enterprise Client Tools

Configuration A

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Puppet Puppet Enterprise Client Tools	From 16.4.0 to 16.4.6
Puppet Puppet Enterprise Client Tools	From 17.3.0 to 17.3.6
Puppet Puppet Enterprise Client Tools	From 18.1.0 to 18.1.2

Running on/with	Platform Versions
Microsoft Windows	All versions

References (2)

https://puppet.com/security/cve/CVE-2018-6516

Source: security@puppet.com

Vendor Advisory

https://puppet.com/security/cve/CVE-2018-6516

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.