CVE-2018-6508

moderate-risk

Published 2018-02-09

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.

Do I need to act?

0.91% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.0/10 High

NETWORK / LOW complexity

Affected Products (1)

Puppet Enterprise

Affected Vendors

Puppet

References (4)

Third Party Advisory http://www.securityfocus.com/bid/103020

Vendor Advisory https://puppet.com/security/cve/CVE-2018-6508

Third Party Advisory http://www.securityfocus.com/bid/103020

Vendor Advisory https://puppet.com/security/cve/CVE-2018-6508

/ 100

moderate-risk

Severity 28/34 · Critical

Exploitability 3/34 · Minimal

Exposure 5/34 · Minimal