CVE-2017-2290

HIGH

mcollective-puppet-agent <1.12.1 - Privilege Escalation

Title source: llm
STIX 2.1

Description

On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/96583
Vendor Advisory x_refsource_confirm
https://puppet.com/security/cve/cve-2017-2290

Scores

CVSS v3 8.8
EPSS 0.0039
EPSS Percentile 59.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-732
Status published
Products (2)
puppet/mcollective-puppet-agent 1.12.0
Puppet/mcollective-puppet-agent plugin 1.12.0
Published Mar 03, 2017
Tracked Since Feb 18, 2026