CVE-2013-1653 — Puppet vulnerability

8 documents7 sources
Severity
7.1HIGHNVD
EPSS
2.0%
top 16.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
PuppetCanonical Ubuntu LinuxPuppet Enterprise+1 more
Timeline
PublishedMar 20
Latest updateMay 14

Description

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.

CVSS vector

AV:N/AC:H/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages4 packages

▶NVDpuppet/puppet_enterprise2.7.0, 2.7.1, 3.1.0+2
▶Debianpuppet/puppet< 2.7.18-3
▶NVDpuppet/puppet2.6.0 — 2.6.17+16
▶NVDpuppetlabs/puppet13 versions+12

Also affects: Ubuntu Linux 11.10, 12.04, 12.10

🔴Vulnerability Details

3
GHSA
GHSA-r53h-f365-v9hc: Puppet before 2↗2022-05-14
▶
OSV
CVE-2013-1653: Puppet before 2↗2013-03-20
▶
CVEList
CVE-2013-1653: Puppet before 2↗2013-03-20
▶

📋Vendor Advisories

2
Ubuntu
Puppet vulnerabilities↗2013-03-12
▶
Debian
CVE-2013-1653: puppet - Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet En...↗2013
▶

💬Community

2
Bugzilla
CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2275 puppet various flaws [fedora-all]↗2013-03-12
▶
Bugzilla
CVE-2013-1653 Puppet: kick connection HTTP PUT request arbitrary code execution↗2013-03-10
▶
CVE-2013-1653 — Puppet vulnerability | cvebase