9

CVE-2013-1640

EPSS 1.95%
Published 20.03.2013 16:55:01
Last modified 11.04.2025 00:51:21
Source cve@mitre.org
Teams watchlist Login
Open Login

The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.

Affected products Warnungen 0 Metrics 2 CWE 0 References 10

Data is provided by the National Vulnerability Database (NVD)

Puppet ≫ Puppet Version < 2.6.18

Puppet ≫ Puppet Version >= 2.7.0 < 2.7.21

Puppet ≫ Puppet Version3.1.0

Puppet ≫ Puppet Enterprise Version < 1.2.7

Puppet ≫ Puppet Enterprise Version2.7.0

Puppet ≫ Puppet Enterprise Version2.7.1

Canonical ≫ Ubuntu Linux Version11.10

Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version12.10

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.95%	0.827

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0710.html

Third Party Advisory

http://secunia.com/advisories/52596

Third Party Advisory

http://ubuntu.com/usn/usn-1759-1

Third Party Advisory

http://www.debian.org/security/2013/dsa-2643

Third Party Advisory

https://puppetlabs.com/security/cve/cve-2013-1640/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2013-1640

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-1640

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-1640

EUVD