{"id":"CVE-2021-27021","details":"A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.","modified":"2026-07-08T06:00:35.457347576Z","published":"2021-07-20T11:15:11.630Z","database_specific":{"unresolved_ranges":[{"source":"CPE_RANGE","vendor_product":"puppet:puppet_enterprise","cpes":["cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"2019.8.7"},{"introduced":"2021.0.0"},{"fixed":"2021.2.0"}]}]},"references":[{"type":"ADVISORY","url":"https://puppet.com/security/cve/cve-2021-27021/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppet","events":[{"introduced":"0"},{"fixed":"39461d5c51a78fb9531fa307630826620cbfbaaa"},{"introduced":"6bd493ed9653e22f2897df44615d5a49d280fb66"},{"fixed":"2b0a129763a4d9f5d861f6ff4ab93b15755a85a6"}],"database_specific":{"cpe":"cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.23.0"},{"introduced":"7.7.0"},{"fixed":"7.8.0"}],"source":"CPE_RANGE"}}],"versions":["7.7.0","6.22.0","6.21.0","6.20.0","6.19.0","6.18.0","6.17.0","6.16.0","6.15.0","6.14.0","6.13.0","6.12.0","6.11.0","6.10.1","6.10.0","6.9.0","6.8.0","6.7.0","6.6.0","6.5.0","6.4.0","6.3.0","6.2.0","4.6.0","4.9.0","4.8.0","4.2.0","4.2.3","4.2.2","4.2.1","4.0.0-rc2","4.0.0-rc1","3.4.0-rc1","3.2.0-rc1","3.1.0-rc2","2.7.0rc1","2.6.0","2.6.0rc4","tags/2.6.0rc3","2.6.0rc3","tags/2.6.0rc2","2.6.0rc2","tags/2.6.0rc1","2.6.0rc1","0.25.1rc2","0.25.1rc1","upstream/0.25.0","0.25.0","0.25.0rc1","0.25.0beta2","0.25.0beta1","0.24.1","0.24.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-27021.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppet-agent","events":[{"introduced":"0"},{"fixed":"3706608c3e9acc1f41ea87128343b3f4c705f3c0"},{"introduced":"8ff066fc0ffaf19d45b231b94d84995bbcb74e4d"},{"fixed":"2e1b5bcb83fdd3a19aa391f61a82b54f0183797d"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.23.0"},{"introduced":"7.7.0"},{"fixed":"7.8.0"}]}}],"versions":["7.2.0","5.99.2","5.99.1","5.99.0","4.99.0","1.3.2","1.3.1","1.3.0","1.2.7","0.3.2","0.3.1","0.3.0","0.2.4","0.2.3","0.2.2","0.2.1","0.2.0","0.1.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-27021.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/puppetlabs/puppetdb","events":[{"introduced":"0"},{"fixed":"5b156223871b6ec61356a4e4fe4d451b771b9955"},{"introduced":"ec5e6b4ec588986b4067f61fc99c9c3ceee46f8e"},{"fixed":"33493a561a9fdbe4b42092d7884303e61c0f5650"}],"database_specific":{"cpe":"cpe:2.3:a:puppet:puppetdb:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.17.0"},{"introduced":"7.0.0"},{"fixed":"7.4.1"}],"source":"CPE_RANGE"}}],"versions":["7.4.0","7.3.1","6.16.1","7.3.0","6.16.0","7.2.0","6.15.0","6.14.0","7.1.0","7.0.1","7.0.0","6.13.1","6.13.0","6.12.2","6.12.1","6.12.0","6.11.3","6.11.2","6.11.1","6.11.0","6.10.1","6.9.1","6.9.0","6.8.1","6.8.0","6.7.3","6.7.2","6.7.1","6.7.0","6.6.0","6.5.0","6.4.0","6.1.0","5.0.1","5.0.0","4.4.0","4.3.0","4.2.0","4.1.0","4.0.0","1.3.0","1.1.1","1.1.0","1.1.0-rc5","1.1.0-rc1","1.1.0-rc4","1.1.0-rc3","1.1.0-rc2","0.11.0","0.10.0","1.0.0rc1","0.9.2","0.9.1","0.9.0","0.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-27021.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}