High severity · published Oct 7, 2022
CVE-2022-3276
Puppetlabs-mysql Command Injection
8.8
CVSS
1.7%
EPSS
No
On KEV
Description
Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
puppetlabs-mysql · Puppet
before 13.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3276
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3276
Vendor Advisory
https://puppet.com/security/cve/CVE-2022-3276
More from puppetlabs-mysql
9.8
CVE-2022-3275
Puppetlabs-apt Command Injection
9.8
CVE-2015-7224
puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user…