CVE-2013-1399

EUVD-2013-1437
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 30%
Affected Products (NVD)
VendorProductVersion
puppetpuppet_enterprise
𝑥
≤ 2.7.0
puppetpuppet_enterprise
2.0.0
puppetpuppet_enterprise
2.5.1
puppetpuppet_enterprise
2.5.2
puppetlabspuppet
2.5.0
puppetlabspuppet
2.6.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
puppet
bullseye
5.5.22-2
fixed
Common Weakness Enumeration
References
https://puppetlabs.com/security/cve/cve-2013-1399
https://puppetlabs.com/security/cve/cve-2013-1399