CVE-2013-4971
published 2014-03-09CVE-2013-4971: Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive…
PriorityP422medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.18%
65.6th percentile
Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | puppet | — | — |
| puppet | puppet_enterprise | <= 3.1.1 | — |
| puppet | puppet_enterprise | — | — |
| puppet | puppet_enterprise | — | — |
| puppet | puppet_enterprise | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_debian5.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2887-wp98-w322: Puppet Enterprise before 3
ghsa_unreviewed·2022-05-14
CVE-2013-4971 [MEDIUM] GHSA-2887-wp98-w322: Puppet Enterprise before 3
Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors.
Debian
CVE-2013-4971: puppet - Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoin...
vendor_debian·2013·CVSS 5.0
CVE-2013-4971 [MEDIUM] CVE-2013-4971: puppet - Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoin...
Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors.
Scope: local
bullseye: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2014-03-09
Published