Home

Description

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

PUBLISHED Reserved 2025-06-02 | Published 2025-06-26 | Updated 2025-07-03 | Assigner Perforce




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unaffected

2018.1.8 (custom)
affected

Credits

TIM Security Red Team Research - https://www.gruppotim.it/it/footer/red-team.html reporter

Marco Ventura finder

Claudia Bartolini finder

Andrea Carlo Maria Dattola finder

Stefano Carbè finder

Massimiliano Brolli finder

References

portal.perforce.com/s/detail/a91PA000001SiDdYAK

cve.org (CVE-2025-5459)

nvd.nist.gov (CVE-2025-5459)

Download JSON