CVE-2021-27021
20.07.2021, 11:15
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
| Vendor | Product | Version |
|---|---|---|
| puppet | puppet | 𝑥 < 6.23.0 |
| puppet | puppet | 7.7.0 ≤ 𝑥 < 7.8.0 |
| puppet | puppet_enterprise | 𝑥 < 2019.8.7 |
| puppet | puppet_enterprise | 2021.0.0 ≤ 𝑥 < 2021.2.0 |
| puppet | puppetdb | 𝑥 < 6.17.0 |
| puppet | puppetdb | 7.0.0 ≤ 𝑥 < 7.4.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-1027 -
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.