« Volver al listado

CVE-2018-6516

Estado: ModificadaAlta (7.8)—

On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Puppet — Puppet Enterprise Client Tools

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-6516",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@puppet.com",
      "affectedData": [
        {
          "vendor": "Puppet",
          "product": "pe-client-tools",
          "versions": [
            {
              "status": "affected",
              "version": "16.4.x prior to 16.4.6"
            },
            {
              "status": "affected",
              "version": "17.3.x prior to 17.3.6"
            },
            {
              "status": "affected",
              "version": "18.1.x prior to 18.1.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-06-14T21:29:00.300",
  "references": [
    {
      "url": "https://puppet.com/security/cve/CVE-2018-6516",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@puppet.com"
    },
    {
      "url": "https://puppet.com/security/cve/CVE-2018-6516",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation."
    },
    {
      "lang": "es",
      "value": "Solo en Windows, con un archivo de configuración específicamente manipulado, un atacante podría hacer que las herramientas del cliente Puppet PE (también conocidas como pe-client-tools) en versiones 16.4.x anteriores a la 16.4.6, versiones 17.3.x anteriores a la 17.3.6 y versiones 18.1.x anteriores a la 18.1.2 carguen código arbitrario con escalado de privilegios."
    }
  ],
  "lastModified": "2026-06-17T02:01:57.017",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise_client_tools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8BC24FF-35BD-4911-A35C-61E0FD7A6D5B",
              "versionEndExcluding": "16.4.6",
              "versionStartIncluding": "16.4.0"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise_client_tools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0D137EF-3CA0-4FD8-B79A-11935218E8DE",
              "versionEndExcluding": "17.3.6",
              "versionStartIncluding": "17.3.0"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise_client_tools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3421E69F-416B-4553-BE18-90ED09BAC0D6",
              "versionEndExcluding": "18.1.2",
              "versionStartIncluding": "18.1.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@puppet.com"
}