CVE-2013-4761

EUVD-2017-0218
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.1 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
puppetpuppet
3.2.1
puppetpuppet
3.2.2
puppetpuppet
3.2.3
puppetlabspuppet
3.2.0
puppetpuppet
2.7.2
puppetlabspuppet
2.7.0
puppetlabspuppet
2.7.1
puppetpuppet_enterprise
2.8.0
puppetpuppet_enterprise
2.8.1
puppetpuppet_enterprise
2.8.2
puppetpuppet_enterprise
3.0.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
puppet
bullseye
5.5.22-2
fixed
squeeze
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
puppet
lucid
ignored
precise
Fixed 2.7.11-1ubuntu2.4
released
quantal
Fixed 2.7.18-1ubuntu1.3
released
raring
Fixed 2.7.18-4ubuntu1.2
released
References
http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html
http://puppetlabs.com/security/cve/cve-2013-4761/
http://rhn.redhat.com/errata/RHSA-2013-1283.html
http://rhn.redhat.com/errata/RHSA-2013-1284.html
http://www.debian.org/security/2013/dsa-2761
http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html
http://puppetlabs.com/security/cve/cve-2013-4761/
http://rhn.redhat.com/errata/RHSA-2013-1283.html
http://rhn.redhat.com/errata/RHSA-2013-1284.html
http://www.debian.org/security/2013/dsa-2761