{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-01T00:30:28.053","vulnerabilities":[{"cve":{"id":"CVE-2016-5713","sourceIdentifier":"security@puppet.com","published":"2017-12-06T15:29:00.217","lastModified":"2026-06-17T00:49:55.027","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0."},{"lang":"es","value":"Las versiones de Puppet Agent anteriores a la 1.6.0 incluían una versión del agente Puppet Execution Protocol (PXP) que pasaba variables del entorno a ejecuciones Puppet. Esto podría permitir la carga de código no autorizado. Este error fue introducido por primera vez en Puppet Agent 1.3.0."}],"affected":[{"source":"security@puppet.com","affectedData":[{"vendor":"Puppet","product":"Puppet Agent","versions":[{"version":"Introduced in 1.3.0, fixed in 1.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:puppet_agent:*:*:*:*:*:*:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"1.6.0","matchCriteriaId":"AAE84DE0-1FFF-43FE-AE90-59FCA9444C9F"}]}]}],"references":[{"url":"https://puppet.com/security/cve/cve-2016-5713","source":"security@puppet.com","tags":["Vendor Advisory"]},{"url":"https://puppet.com/security/cve/cve-2016-5713","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}