cbcvebase.
CVE-2013-1398
published 2014-03-14

CVE-2013-1398: The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote…

PriorityP338high8.5CVSS 2.0
AVNACMAuSCCICAC
EPSS
1.54%
74.5th percentile
The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.

Affected

7 ranges
VendorProductVersion rangeFixed in
debianpuppet——
puppetpuppet_enterprise<= 2.7.0—
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetlabspuppet——
puppetlabspuppet——

CVSS provenance

nvdv2.08.5HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
vendor_debian8.5LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.