← Vulnerability feed

Vulnerability record · CVE-2014-3248 · published 16 November 2014

CVE-2014-3248: Puppet facter vulnerability

Puppet · Facter

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

6.2 CVSS 2.0 Medium EPSS 0.54% · top 53.9% CWE-17 · CWE-17
6.2CVSS 2.0 base score
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
6Affected product versions listed by NVD
10References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

AV:L/AC:H/Au:N/C:C/I:C/A:C

Affected products

6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://puppetlabs.com/security/cve/cve-2014-3248 Vendor Advisory
http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/ ExploitTechnical Description
http://secunia.com/advisories/59197 Technical Description
http://secunia.com/advisories/59200 Technical Description
http://www.securityfocus.com/bid/68035 Third Party AdvisoryVDB Entry
http://puppetlabs.com/security/cve/cve-2014-3248 Vendor Advisory
http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet/ ExploitTechnical Description
http://secunia.com/advisories/59197 Technical Description
http://secunia.com/advisories/59200 Technical Description
http://www.securityfocus.com/bid/68035 Third Party AdvisoryVDB Entry

Track CVE-2014-3248 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-5309Puppet enterprise vulnerabilityVersions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.EPSS 0.62%9.8CVE-2023-2530Puppet enterprise vulnerabilityA privilege escalation allowing remote code execution was discovered in the orchestration service.EPSS 1.1%9.8CVE-2021-27023Puppet agent vulnerabilityA flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different ho…EPSS 1.4%9.8CVE-2014-0175Puppet marionette collective hard-coded credentials vulnerabilitymcollective has a default password set at installEPSS 2.0%9.8CVE-2019-10694Puppet enterprise hard-coded credentials vulnerabilityThe express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin passwor…EPSS 1.1%9.8CVE-2018-11749Puppet enterprise cleartext transmission vulnerabilityWhen users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affec…EPSS 0.76%9.8CVE-2018-6512Puppet pe-razor-server code injection vulnerabilityThe previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet …EPSS 1.9%9.8CVE-2016-2788Puppet marionette collective improper access control vulnerabilityMCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the …EPSS 2.3%

Source: NIST National Vulnerability Database (record CVE-2014-3248), CISA KEV, FIRST EPSS (scores of 2026-11-14). This page is refreshed as NVD updates the record.