First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2023-5214

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Puppet	Bolt	>= prior to 3.27.4, <= 3.27.4

References

https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-boltVendor Advisory
https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-boltVendor Advisory

Timeline

Published: Oct 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-521428.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cool Plugins Events Shortcodes For The CVE-2023-521437.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout:CVE-2023-521445.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue aff CVE-2023-521458.8Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a th CVE-2023-521465.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a t CVE-2023-521473.7Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & CVE-2023-521485.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects CVE-2023-521498.8Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0.CVE-2023-52156.5A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value).CVE-2023-521508.8Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Eleme CVE-2023-521515.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Uncanny Automator, Uncanny Owl Uncanny Automator – Automate ever CVE-2023-521527.5mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalcul