VulnerabilityModified
CVE-2022-3276
Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0.
HIGH 8.8EPSS 1.65%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.65% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- puppet/puppetlabs-mysql
- Source
- security@puppet.com
References
- https://puppet.com/security/cve/CVE-2022-3276Vendor Advisory
- https://puppet.com/security/cve/CVE-2022-3276Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.