{"id":"CVE-2025-5459","state":"PUBLISHED","title":"OS Command Injection","description":"A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.","publishedAt":"2025-06-26T06:30:56.546Z","updatedAt":"2026-09-04T01:16:09.883Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Perforce"},"assigner":"Perforce","products":["Perforce Puppet Enterprise"],"affected":[{"vendor":"Perforce","product":"Puppet Enterprise","defaultStatus":"unaffected","versions":[{"version":"2018.1.8","status":"affected","lessThanOrEqual":"2023.8.3, 2025.3","versionType":"custom"}]}],"references":["https://portal.perforce.com/s/detail/a91PA000001SiDdYAK","http://seclists.org/fulldisclosure/2026/Sep/9"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/5xxx/CVE-2025-5459.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-5459","state":"PUBLISHED","datePublished":"2025-06-26T06:30:56.546Z","dateUpdated":"2026-09-04T01:16:09.883Z","assignerShortName":"Perforce","assignerOrgId":"ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e","dateReserved":"2025-06-02T09:29:25.872Z"},"containers":{"cna":{"title":"OS Command Injection","descriptions":[{"lang":"en","value":"A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0."}],"affected":[{"vendor":"Perforce","product":"Puppet Enterprise","defaultStatus":"unaffected","versions":[{"version":"2018.1.8","status":"affected","lessThanOrEqual":"2023.8.3, 2025.3","versionType":"custom"}]}],"references":[{"url":"https://portal.perforce.com/s/detail/a91PA000001SiDdYAK"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Perforce","orgId":"ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e","dateUpdated":"2025-07-03T09:25:04.719Z"},"credits":[{"lang":"en","type":"reporter","value":"TIM Security Red Team Research - https://www.gruppotim.it/it/footer/red-team.html"},{"lang":"en","type":"finder","value":"Marco Ventura"},{"lang":"en","type":"finder","value":"Claudia Bartolini"},{"lang":"en","type":"finder","value":"Andrea Carlo Maria Dattola"},{"lang":"en","type":"finder","value":"Stefano Carbè"},{"lang":"en","type":"finder","value":"Massimiliano Brolli"}],"datePublic":"2025-06-25T18:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-26T13:30:51.791004Z","id":"CVE-2025-5459","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-26T13:31:04.769Z"}},{"title":"CVE Program Container","references":[{"url":"http://seclists.org/fulldisclosure/2026/Sep/9"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-09-04T01:16:09.883Z"}}]}}}