SQL Injection in Puppet
CVE-2021-27021
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
EPSS: 0.013 (66.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Puppet
- Puppet Puppetdb
- Puppet Puppet_enterprise
- N/a Puppet Db — versions All prior versions before Puppet DB 6.17.0, 7.4.1, Puppet Platform 6.23, 7.8.0 and PE 2021.2, 2019.8.7
Weakness classification (CWE)
References
- security@puppet.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-27021?
- CVE-2021-27021 is a high-severity vulnerability in Puppet, classified under CWE-1027. CVSS score: 8.8/10. Published 2021-07-20.
- How severe is CVE-2021-27021?
- High severity. CVSS v3 base score is 8.8 out of 10.