CVE-2017-2298 Vulnerability Details

  /     /     /  

CVE-2017-2298 Metadata Quick Info

CVE Published: 30/06/2017 | CVE Updated: 16/09/2024 | CVE Year: 2017
Source: puppet | Vendor: Puppet | Product: mcollective
Status : PUBLISHED

---

CVE-2017-2298 Description

The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to an arbitrary location on the client with the filename appended with the string "_pub.pem".

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: missing input sanitization
Source: Puppet

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).