CVE-2013-1399

Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
VendorProductVersion
puppetpuppet_enterprise
𝑥
≤ 2.7.0
puppetpuppet_enterprise
2.0.0
puppetpuppet_enterprise
2.5.1
puppetpuppet_enterprise
2.5.2
puppetlabspuppet
2.5.0
puppetlabspuppet
2.6.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
puppet
bullseye
5.5.22-2
fixed
Common Weakness Enumeration
References
https://puppetlabs.com/security/cve/cve-2013-1399
https://puppetlabs.com/security/cve/cve-2013-1399