What’s Vulnerable › Vulnerabilities

CVE-2017-2290

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-03-03 · updated 2026-06-17
• Weakness: CWE-732

Description

On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1.

Affected products

• Puppet mcollective-puppet-agent plugin: 1.12.0

References

• http://www.securityfocus.com/bid/96583
• https://puppet.com/security/cve/cve-2017-2290
• http://www.securityfocus.com/bid/96583
• https://puppet.com/security/cve/cve-2017-2290

Get alerted when CVE-2017-2290 or the next vulnerability affects your stack