What is CVE-2017-2293?

CVE-2017-2293 is a medium-severity vulnerability in Puppet Enterprise. CVSS score: 4.9/10. Published 2018-02-01.

How severe is CVE-2017-2293?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Puppet Enterprise

CVE-2017-2293

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to…

EPSS: 0.007 (48.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products

Puppet Enterprise — versions prior to 2016.4.5, 2016.5.x, 2017.1.x, resolved in 2016.4.5 and 2017.2.1
Puppet Puppet_enterprise — versions 2016.5.1, 2016.5.2, 2017.1.0

References

security@puppet.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-2293?: CVE-2017-2293 is a medium-severity vulnerability in Puppet Enterprise. CVSS score: 4.9/10. Published 2018-02-01.
How severe is CVE-2017-2293?: Medium severity. CVSS v3 base score is 4.9 out of 10.