CVE-2013-4962

EPSS 0.35%
Veröffentlicht 20.08.2013 22:55:04
Zuletzt bearbeitet 11.04.2025 00:51:21
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Puppet ≫ Puppet Enterprise Version <= 3.0.0

Puppet ≫ Puppet Enterprise Version2.5.1

Puppet ≫ Puppet Enterprise Version2.5.2

Puppet ≫ Puppet Enterprise Version2.8.0

Puppet ≫ Puppet Enterprise Version2.8.1

Puppet ≫ Puppet Enterprise Version2.8.2

Puppet ≫ Puppet Enterprise Version2.8.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.35%	0.544

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.8	8.6	4.9	AV:N/AC:M/Au:N/C:N/I:P/A:P

http://puppetlabs.com/security/cve/cve-2013-4962/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2013-4962

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-4962

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-4962

EUVD