CVE-2008-6556: Puppet Master Webutil

High severity, CVSS 10.0. EPSS: 3.2% chance of exploitation in the next 30 days.

cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command.

Affected products

• Puppet Master Webutil: version 2.3 only

Published 2009-03-30. Last modified 2026-06-16.