CVE-2013-1399 — Cross-Site Request Forgery in Enterprise

CWE-352 — Cross-Site Request Forgery4 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
0.1%
top 69.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Puppet EnterprisePuppetlabs Puppet
Timeline
PublishedMar 14
Latest updateMay 14

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶NVDpuppetlabs/puppet2.5.0, 2.6.0+1

🔴Vulnerability Details

2
GHSA
GHSA-763p-p3fq-9rj5: Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration compon↗2022-05-14
▶
CVEList
CVE-2013-1399: Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration compon↗2014-03-14
▶

📋Vendor Advisories

1
Debian
CVE-2013-1399: puppet - Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node reque...↗2013
▶
CVE-2013-1399 — Cross-Site Request Forgery | cvebase