CVE-2023-5214.yml

---
gem: bolt
cve: 2023-5214
ghsa: 289m-2964-f8q5
url: https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt
title: Puppet Bolt privilege escalation vulnerability
date: 2023-10-06
description: |
  In Puppet Bolt versions prior to 3.27.4, a path
  to escalate privileges was identified.
cvss_v3: 9.8
patched_versions:
  - ">= 3.27.4"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-5214
    - https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt
    - https://yanac.hu/2023/10/07/cve-2023-5214-puppetlabs-puppet-bolt-up-to-3-27-3-privileges-management
    - https://github.com/advisories/GHSA-289m-2964-f8q5