Home > Vulnerability Database > CVE-2012-1988

Mend.io Vulnerability Database

CVE-2012-1988

Date: May 29, 2012

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.

Language: Ruby

Severity Score

5.0

Related Resources (33)

Url: http://puppetlabs.com/security/cve/cve-2012-1988/

Url: https://web.archive.org/web/20120513213112/http://projects.puppetlabs.com/issues/13518

Url: http://puppetlabs.com/security/cve/cve-2012-1988

Url: http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15

Url: https://web.archive.org/web/20121025194938/http://secunia.com/advisories/48743

Url: https://web.archive.org/web/20120816020421/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15

Url: https://hermes.opensuse.org/messages/15087408

Url: https://web.archive.org/web/20121025112409/http://secunia.com/advisories/48789

Url: https://web.archive.org/web/20121013181707/http://puppetlabs.com/security/cve/cve-2012-1988

Url: https://web.archive.org/web/20121025113446/http://secunia.com/advisories/48748

Url: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1988.yml

Url: https://nvd.nist.gov/vuln/detail/CVE-2012-1988

Url: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html

Url: https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975

Url: http://projects.puppetlabs.com/issues/13518

Url: http://www.securityfocus.com/bid/52975

Url: http://www.debian.org/security/2012/dsa-2451

Url: https://github.com/puppetlabs/puppet/commit/568ded50ec6cc498ad32ff7f086d9f73b5d24c14

Url: http://www.osvdb.org/81309

Url: https://github.com/puppetlabs/puppet/commit/0d6d29933e613fe177e9235415919a5428db67bc

Url: https://web.archive.org/web/20121025194830/http://secunia.com/advisories/49136

Url: http://secunia.com/advisories/48789

Url: https://github.com/puppetlabs/puppet

Url: https://web.archive.org/web/20121031092646/http://www.securityfocus.com/bid/52975

Url: http://secunia.com/advisories/48748

Url: https://hermes.opensuse.org/messages/14523305

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/74796

Url: http://ubuntu.com/usn/usn-1419-1

Url: http://secunia.com/advisories/49136

Url: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html

Url: http://secunia.com/advisories/48743

Url: https://www.mend.io/vulnerability-database/CVE-2012-1988

Severity Score

5.0

Weakness Type (CWE)

Command Injection

CWE-77

OS Command Injections

CWE-78

CVSS v3.1

Base Score:	5.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	6.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	SINGLE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2012-1988

Date: May 29, 2012

Language: Ruby

Severity Score

Related Resources (33)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?