VYPR
← All advisories
High severity8.8NVD Advisory· Published Jun 11, 2018· Updated Jun 17, 2026

CVE-2018-6513

CVE-2018-6513

Description

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths.

Affected products

3
  • Puppet (software)/Puppet Enterprisellm-fuzzy2 versions
    >=2016.4.0 <2016.4.12 || >=2017.3.0 <2017.3.7 || >=2018.1.0 <2018.1.1+ 1 more
    • (no CPE)range: >=2016.4.0 <2016.4.12 || >=2017.3.0 <2017.3.7 || >=2018.1.0 <2018.1.1
    • (no CPE)range: Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2
  • Puppet (software)/Puppet Agentllm-fuzzy
    Range: >=1.10.0 <1.10.13 || >=5.3.0 <5.3.7 || >=5.5.0 <5.5.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.