cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote malicious users to execute arbitrary commands via shell metacharacters in the details command.
puppetmaster webutil 2.7