CVE-2025-5459

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://portal.perforce.com/s/detail/a91PA000001SiDdYAK	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:puppet:puppet_enterprise::::::::
	cpe:2.3:a:puppet:puppet_enterprise:2025.3.0:::::::*

History

14 Oct 2025, 17:00

Type	Values Removed	Values Added
First Time		Puppet puppet Enterprise Puppet
CPE		cpe:2.3:a:puppet:puppet_enterprise:::::::: cpe:2.3:a:puppet:puppet_enterprise:2025.3.0:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
References	~~() https://portal.perforce.com/s/detail/a91PA000001SiDdYAK -~~	() https://portal.perforce.com/s/detail/a91PA000001SiDdYAK - Third Party Advisory

26 Jun 2025, 18:57

Type	Values Removed	Values Added
Summary		(es) Un usuario con permisos específicos de edición de grupos de nodos y un parámetro de clase especialmente manipulado podría ejecutar comandos como root en el host principal. Esto afecta a las versiones 2018.1.8 a 2023.8.3 y 2025.3 de Puppet Enterprise y se ha resuelto en las versiones 2023.8.4 y 2025.4.0.

26 Jun 2025, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-26 07:15

Updated : 2025-10-14 17:00

NVD link : CVE-2025-5459

Mitre link : CVE-2025-5459

CVE.ORG link : CVE-2025-5459

JSON object : View

Products Affected

puppet

puppet_enterprise

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-5459", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@puppet.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-26T07:15:27.440", "references": [{"url": "https://portal.perforce.com/s/detail/a91PA000001SiDdYAK", "tags": ["Third Party Advisory"], "source": "security@puppet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@puppet.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0."}, {"lang": "es", "value": "Un usuario con permisos espec\u00edficos de edici\u00f3n de grupos de nodos y un par\u00e1metro de clase especialmente manipulado podr\u00eda ejecutar comandos como root en el host principal. Esto afecta a las versiones 2018.1.8 a 2023.8.3 y 2025.3 de Puppet Enterprise y se ha resuelto en las versiones 2023.8.4 y 2025.4.0."}], "lastModified": "2025-10-14T17:00:33.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "869E3554-A015-407C-8160-53EF8CB6885B", "versionEndExcluding": "2023.8.4", "versionStartIncluding": "2018.1.8"}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2025.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2FD6A70-B858-44EE-9F0D-762E0814F535"}], "operator": "OR"}]}], "sourceIdentifier": "security@puppet.com"}