5

CVE-2013-2716

Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Puppet ≫ Puppet Enterprise Version <= 2.7.2
Puppet ≫ Puppet Enterprise Version 2.0.0
Puppet ≫ Puppet Enterprise Version 2.5.1
Puppet ≫ Puppet Enterprise Version 2.5.2
Puppetlabs ≫ Puppet Version 1.0.0 Update - Edition enterprise
Puppetlabs ≫ Puppet Version 1.1.0 Update - Edition enterprise
Puppetlabs ≫ Puppet Version 1.2.0 Update - Edition enterprise
Puppetlabs ≫ Puppet Version 2.5.0 Update - Edition enterprise
Puppetlabs ≫ Puppet Version 2.6.0 Update - Edition enterprise
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.32% 0.671
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://secunia.com/advisories/52862
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/83171
https://puppetlabs.com/security/cve/cve-2013-2716/
Vendor Advisory