CVE-2025-5459 - CVE House
Back to Database
Status published High CVE-2025-5459

OS Command Injection

Vulnerability Description

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-5459

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • TIM Security Red Team Research - https://www.gruppotim.it/it/footer/red-team.html
  • Marco Ventura
  • Claudia Bartolini
  • Andrea Carlo Maria Dattola
  • Stefano Carbè
  • Massimiliano Brolli

References

More from Perforce

View All →
CVE-2025-3113
Improper Access Control in Delphix Masking Engine
Critical 9
CVE-2025-2903
Privilege Chaining in Delphix
High 8.5
CVE-2025-1714
Username Enumeration in Gliffy
Medium 6.9
CVE-2025-14591
PII Leak Due to Change in EOR Handling
Medium 5.3
CVE-2025-13472
Missing authorization in BlazeMeter Jenkins Plugin
Medium 5.3

Affected Vendor

Affected Software

Puppet Enterprise
Vulnerable Versions:
2018.1.8

Timeline

Official Publish: June 26th, 2025
Last Modified: July 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration