2 lines
3.0 KiB
JSON
2 lines
3.0 KiB
JSON
{"affected":[{"affectedData":[{"product":"mcollective-puppet-agent plugin","vendor":"Puppet","versions":[{"status":"affected","version":"1.12.0"}]}],"source":"security@puppet.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:puppet:mcollective-puppet-agent:1.12.0:*:*:*:*:puppet:*:*","matchCriteriaId":"4571FE0F-CE25-424E-B871-7342AC6CD9FA","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","matchCriteriaId":"2CF61F35-5905-4BA9-AD7E-7DB261D2F256","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next \"mco puppet\" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1."},{"lang":"es","value":"En instalaciones de Windows del plugin mcollective-puppet-agent, versión 1.12.0, un usuario no administrador puede crear un ejecutable que será ejecutado con privilegios de administrador en la siguiente ejecución \"mco puppet\". Usuarios de Puppet Enterprise no están afectados. Esto está resuelto en mcollective-puppet-agent 1.12.1."}],"id":"CVE-2017-2290","lastModified":"2026-06-17T01:15:53.900","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"COMPLETE","baseScore":9.0,"confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","version":"2.0"},"exploitabilityScore":8.0,"impactScore":10.0,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2017-03-03T15:59:00.647","references":[{"source":"security@puppet.com","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/96583"},{"source":"security@puppet.com","tags":["Vendor Advisory"],"url":"https://puppet.com/security/cve/cve-2017-2290"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/96583"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://puppet.com/security/cve/cve-2017-2290"}],"sourceIdentifier":"security@puppet.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"nvd@nist.gov","type":"Primary"}]}
|