CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
96.5%
Puppet Developers report:
When making REST api calls, the puppet master takes YAML from an
untrusted client, deserializes it, and then calls methods on the
resulting object. A YAML payload can be crafted to cause the
deserialization to construct an instance of any class available in
the ruby process, which allows an attacker to execute code
contained in the payload.