Vulnerability · Published Jul 20, 2021 · Assigned by puppet

CVE-2021-27021

High 8.8

In plain English

A high-severity security flaw in Puppet DB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)1.3%top 30.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	puppetdb	7.11.2-2	DEBIAN-CVE-2021-27021
Debian:13	puppetdb	7.11.2-2	DEBIAN-CVE-2021-27021
Ubuntu:22.04:LTS	puppetdb	no fix listed	UBUNTU-CVE-2021-27021

Affected products (as reported)

Vendor	Product	Versions
n/a	Puppet DB	All prior versions before Puppet DB 6.17.0, 7.4.1, Puppet Platform 6.23, 7.8.0 and PE 2021.2, 2019.8.7

Weakness: CWE-1027

References

https://puppet.com/security/cve/cve-2021-27021/ x_refsource_MISC