CVE-2016-5713

    Dashboard / Vulnerabilities / CVE-2016-5713

    CVE-2016-5713

    Published: 6 Dec 2017Last Modified: 8 Jul 2026

    Summary:

    Details: Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0.

    References: https://puppet.com/security/cve/cve-2016-5713

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- fe749a8b064afa356c145c2549df606f7cfd98c9
    Fixed -30d260df76bfed4e1179b2f3ec9dd26972e561d8

    Affected versions

    1.3.2
    1.3.1
    1.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High