CVE-2013-4761
At a glance
- Source
- NVD
- EPSS
- EPSS 1.64 % · percentile 76 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-cj43-9h3w-v976 — Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service
European references
- ENISA EUVD · EUVD-2017-0218
- GCVE · GCVE-0-2013-4761
CERT-FR advisories
- CERTA-2013-AVI-482 — Multiples vulnérabilités dans Puppet · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:*cpe:2.3:a:puppet:puppet:3.2.2:*:*:*:*:*:*:*cpe:2.3:a:puppet:puppet:3.2.3:*:*:*:*:*:*:*cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:*cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*cpe:2.3:a:puppet:puppet_enterprise:3.0.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |