CVE-2016-2788

Critical

Published: 13/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

MCollective versions 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allow remote attackers to execute arbitrary code via the mco ping command.

Risk Assessment

Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise.

Recommendation

It is recommended to upgrade MCollective to version 2.8.9 or later to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command.