cbcvebase.
CVE-2013-4963
published 2014-03-14

CVE-2013-4963: Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users…

PriorityP425medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
0.83%
55.2th percentile
Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a (1) report, (2) group, or (3) class or possibly have other unspecified impact.

Affected

15 ranges
VendorProductVersion rangeFixed in
debianpuppet——
puppetpuppet_enterprise<= 3.0.0—
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——
puppetpuppet_enterprise——

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_debian6.8LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.