puppetlabs/bolt · Security
Puppet Bolt privilege escalation vulnerability
- GHSA ID
- GHSA-289m-2964-f8q5
- CVE ID
- CVE-2023-5214
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.
CWEs
- CWE-269 · Improper Privilege Management
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-5214 ↗
- https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates ↗
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bolt/CVE-2023-5214.yml ↗
- https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt ↗
- https://github.com/advisories/GHSA-289m-2964-f8q5 ↗