CVE-2014-3248

mediumPriorität · verfolgen · 25EPSS 0.005 · 45. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.54% (45th) EPSS

CVSS 6.2 · medium

Is it mine?

16 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · bewertet 2026-10-27

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.06.2mediumAV:L/AC:H/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 1.9 · Auswirkung 10

v2.06.2mediumAV:L/AC:H/Au:N/C:C/I:C/A:Csecondary · FSTEC (BDU) RU

v2.05.3mediumAV:L/AC:H/Au:N/C:C/I:C/A:C/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-17USprimärCWE-17US

betroffene Produkte (16)

Betroffene Produkte und Versionsbereiche.

n/a n/a≤ n/aenisa_euvdEU
Gentoo Foundation Inc. Gentoo Linux≤ 20140826fstec_bduRU
puppet facter= 2.0.0nvdUScpe:2.3:a:puppet:facter:*:*:*:*:*:*:*:*
puppet facter= 2.0.1nvdUScpe:2.3:a:puppet:facter:*:*:*:*:*:*:*:*
puppet hiera< 1.3.4nvdUScpe:2.3:a:puppet:hiera:*:*:*:*:*:*:*:*
puppet marionette collective< 2.5.2nvdUScpe:2.3:a:puppet:marionette_collective:*:*:*:*:*:*:*:*
puppet puppet< 2.7.26nvdUScpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*
puppet puppet3.6.0 → 3.6.2nvdUScpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*
puppet puppet enterprise2.8.0 → 2.8.7nvdUScpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*
puppetlabs facter1.6.0 → 1.6.18nvdUScpe:2.3:a:puppetlabs:facter:*:*:*:*:*:*:*:*
RubyGems facter< 1.7.6osvUSpkg:gem/facter
RubyGems facter2.0.0 → 2.0.2osvUSpkg:gem/facter
RubyGems hiera< 1.3.4osvUSpkg:gem/hiera
RubyGems mcollective-client< 2.5.2osvUSpkg:gem/mcollective-client
RubyGems puppet< 2.7.26osvUSpkg:gem/puppet
RubyGems puppet3.0.0 → 3.6.2osvUSpkg:gem/puppet

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-92v7-pq4h-58j5facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability2017-10-24ghsa · osvUS
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) `rubygems/defaults/operating_system.rb`, (2) `Win32API.rb`, (3) `Win32API.so`, (4) `safe_yaml.rb`, (5) `safe_yaml/deep.rb`, or (6) `safe_yaml/deep.so`; or (7) `operatingsystem.rb`, (8) `operatingsystem.so`, (9) `osfamily.rb`, or (10) `osfamily.so` in `puppet/confine`.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

veröffentlicht 2014-11-16geändert 2026-06-17

verwandt (812)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-41125US	—OT kritisch	3.05% (87th)	KEV	2022-11-09
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
CVE-2022-21445US	high7.5OT kritisch	62.5% (99th)	KEV	2022-04-19
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0…
CVE-2022-26258US	critical9.8OT kritisch	91.6% (100th)	KEV	2022-03-28
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.
CVE-2017-8543US	critical9.8OT kritisch	74.4% (99th)	KEV	2017-06-15
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1,…
CVE-2017-8464US	high8.8OT kritisch	90.0% (100th)	KEV	2017-06-15
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607,…

+807 weitere

Referenzen (15)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan