Description

All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.

Remediation

References

https://github.com/olindata/node-puppet-facter/blob/f34bcc754325d71bb3b1b534804e53d6170f15f5/index.js%23L10

https://security.snyk.io/vuln/SNYK-JS-PUPPETFACTER-3175616

Related Vulnerabilities

CVE-2020-2188 Vulnerability in maven package org.jenkins-ci.plugins:ec2

CVE-2020-23622 Vulnerability in maven package org.fourthline.cling:cling-core

CVE-2016-6797 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2023-26152 Vulnerability in npm package static-server

CVE-2022-44310 Vulnerability in npm package ecdh

Severity

High

Classification

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory NVD-CWE-Other