CVE-2025-5459 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

Reserved 2025-06-02 | Published 2025-06-26 | Updated 2025-06-26 | Assigner Perforce

HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status

unaffected

2018.1.8

affected

Credits

TIM Security Red Team Research reporter

Marco Ventura finder

Claudia Bartolini finder

Andrea Carlo Maria Dattola finder

Stefano Carbè finder

Massimiliano Brolli finder

References

portal.perforce.com/s/detail/a91PA000001SiDdYAK

cve.org (CVE-2025-5459)

nvd.nist.gov (CVE-2025-5459)

Download JSON

https://cve.threatint.eu/CVE/CVE-2025-5459

Support options

Helpdesk Chat, Email, Knowledgebase