CVE-2018-6515

HIGH

Puppet Agent 1.10.0-1.10.12, 5.3.0-5.3.6, 5.5.0-5.5.1 - Privilege Escalation via Crafted Configuration File

Title source: llm
STIX 2.1

Description

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://puppet.com/security/cve/CVE-2018-6515

Scores

CVSS v3 7.8
EPSS 0.0085
EPSS Percentile 53.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (1)
puppet/puppet 1.10.0 - 1.10.13
Published Jun 11, 2018
Tracked Since Feb 18, 2026