CVE-2013-1398

published 2014-03-14

CVE-2013-1398: The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote…

Priority P3 38 high 8.5 CVSS 2.0

AV N AC M Au S C C I C A C

The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	puppet	—	—
puppet	puppet_enterprise	<= 2.7.0	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	—	—
puppetlabs	puppet	—	—
puppetlabs	puppet	—	—

CVSS provenance

nvd v2.0 8.5 HIGH AV:N/AC:M/Au:S/C:C/I:C/A:C

vendor_debian 8.5 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-310