In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Puppet | Puppet | * | * |
| Puppet | Puppet | 1.10.0 | * |
| Puppet_enterprise | Puppet | * | * |
| Puppet_enterprise | Puppet | 2017.1.0 | * |