CVE-2022-3276: Puppetlabs-mysql Command Injection
Published Oct 7, 2022
·Updated
Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
Affected Software
1 affected component
Puppet puppetlabs-mysql<13.0.0
Event History
Oct 7, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this command injection vulnerability?
The vulnerability ID for this command injection vulnerability is CVE-2022-3276.
2
What is the severity level of CVE-2022-3276?
The severity level of CVE-2022-3276 is high with a CVSS score of 8.8.
3
Which version of the puppetlabs-mysql module is affected by CVE-2022-3276?
The puppetlabs-mysql module prior to version 13.0.0 is affected by CVE-2022-3276.
4
How can the command injection vulnerability be exploited?
The command injection vulnerability can be exploited by providing unsanitized input to the puppetlabs-mysql module.
5
Is the command injection vulnerability common in most deployments of Puppet and Puppet Enterprise?
No, the command injection vulnerability is rare in most deployments of Puppet and Puppet Enterprise.