9

CVE-2013-1640

EPSS 1.95%
Veröffentlicht 20.03.2013 16:55:01
Zuletzt bearbeitet 11.04.2025 00:51:21
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Puppet ≫ Puppet Version < 2.6.18

Puppet ≫ Puppet Version >= 2.7.0 < 2.7.21

Puppet ≫ Puppet Version3.1.0

Puppet ≫ Puppet Enterprise Version < 1.2.7

Puppet ≫ Puppet Enterprise Version2.7.0

Puppet ≫ Puppet Enterprise Version2.7.1

Canonical ≫ Ubuntu Linux Version11.10

Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version12.10

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.95%	0.827

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0710.html

Third Party Advisory

http://secunia.com/advisories/52596

Third Party Advisory

http://ubuntu.com/usn/usn-1759-1

Third Party Advisory

http://www.debian.org/security/2013/dsa-2643

Third Party Advisory

https://puppetlabs.com/security/cve/cve-2013-1640/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2013-1640

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-1640

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-1640

EUVD