Description

All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.

Remediation

References

https://github.com/olindata/node-puppet-facter/blob/f34bcc754325d71bb3b1b534804e53d6170f15f5/index.js%23L10

https://security.snyk.io/vuln/SNYK-JS-PUPPETFACTER-3175616

Related Vulnerabilities

CVE-2020-15252 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2021-42697 Vulnerability in maven package com.typesafe.akka:akka-http-core_2.12

CVE-2018-1288 Vulnerability in maven package org.apache.kafka:kafka_2.11

CVE-2018-1000023 Vulnerability in npm package insight-api

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.vitotronic

Severity

High

Classification

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory NVD-CWE-Other