High severity8.8NVD Advisory· Published Mar 3, 2017· Updated May 13, 2026
CVE-2017-2290
CVE-2017-2290
Description
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1.
Affected products
2- cpe:2.3:a:puppet:mcollective-puppet-agent:1.12.0:*:*:*:*:puppet:*:*
- Puppet/mcollective-puppet-agent pluginv5Range: 1.12.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.securityfocus.com/bid/96583nvdThird Party AdvisoryVDB Entry
- puppet.com/security/cve/cve-2017-2290nvdVendor Advisory
News mentions
0No linked articles in our index yet.