« Volver al listado

CVE-2017-2290

Estado: ModificadaAlta (8.8)—

On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Puppet — Mcollective-puppet-agent

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-2290",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@puppet.com",
      "affectedData": [
        {
          "vendor": "Puppet",
          "product": "mcollective-puppet-agent plugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.12.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-03T15:59:00.647",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/96583",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@puppet.com"
    },
    {
      "url": "https://puppet.com/security/cve/cve-2017-2290",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@puppet.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/96583",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://puppet.com/security/cve/cve-2017-2290",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next \"mco puppet\" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1."
    },
    {
      "lang": "es",
      "value": "En instalaciones de Windows del plugin mcollective-puppet-agent, versión 1.12.0, un usuario no administrador puede crear un ejecutable que será ejecutado con privilegios de administrador en la siguiente ejecución \"mco puppet\". Usuarios de Puppet Enterprise no están afectados. Esto está resuelto en mcollective-puppet-agent 1.12.1."
    }
  ],
  "lastModified": "2026-06-17T01:15:53.900",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:puppet:mcollective-puppet-agent:1.12.0:*:*:*:*:puppet:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4571FE0F-CE25-424E-B871-7342AC6CD9FA"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@puppet.com"
}