CVE-2022-3276

Published: Oct 7, 2022Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.

Affected (1)

Products: Puppet: Puppetlabs Mysql

1 product

Puppetlabs Mysql

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppetlabs Mysql	Before 13.0.0

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://puppet.com/security/cve/CVE-2022-3276

Source: security@puppet.com

Vendor Advisory

https://puppet.com/security/cve/CVE-2022-3276

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.