CVE-2013-2716 — Enterprise vulnerability

CWE-3103 documents3 sources

Severity

5.0MEDIUMNVD

EPSS

0.3%

top 46.81%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Puppet Enterprise Puppetlabs Puppet

Timeline

PublishedApr 10

Latest updateMay 14

Description

Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDpuppet/puppet_enterprise2.7.2+3

▶NVDpuppetlabs/puppet5 versions+4

🔴Vulnerability Details

GHSA

GHSA-6576-382v-5xmw: Puppet Labs Puppet Enterprise before 2↗2022-05-14

▶

CVEList

CVE-2013-2716: Puppet Labs Puppet Enterprise before 2↗2013-04-10

▶