CVE-2013-4761 : Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4,

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Published 2013-08-20 22:55:04

Updated 2019-07-10 18:10:45

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2013-4761

Puppet » Puppet » Version: 2.7.2
cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
Matching versions
Puppet » Puppet » Version: 3.2.1
cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:*
Matching versions
Puppet » Puppet » Version: 3.2.2
cpe:2.3:a:puppet:puppet:3.2.2:*:*:*:*:*:*:*
Matching versions
Puppet » Puppet » Version: 3.2.3
cpe:2.3:a:puppet:puppet:3.2.3:*:*:*:*:*:*:*
Matching versions
Puppet » Puppet Enterprise » Version: 2.8.0
cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*
Matching versions
Puppet » Puppet Enterprise » Version: 3.0.0
cpe:2.3:a:puppet:puppet_enterprise:3.0.0:*:*:*:*:*:*:*
Matching versions
Puppet » Puppet Enterprise » Version: 2.8.1
cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*
Matching versions
Puppet » Puppet Enterprise » Version: 2.8.2
cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*
Matching versions
Puppetlabs » Puppet » Version: 2.7.0
cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
Matching versions
Puppetlabs » Puppet » Version: 2.7.1
cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
Matching versions
Puppetlabs » Puppet » Version: 3.2.0
cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2013-4761

EPSS FAQ

1.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 82 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-4761

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.1	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:P	4.9	6.4	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2013-4761

http://rhn.redhat.com/errata/RHSA-2013-1284.html

RHSA-2013:1284 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2013-1283.html

RHSA-2013:1283 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://www.debian.org/security/2013/dsa-2761

Debian -- Security Information -- DSA-2761-1 puppet

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html

[security-announce] SUSE-SU-2014:0155-1: important: Security update for
http://puppetlabs.com/security/cve/cve-2013-4761/

CVE-2013-4761 | Puppet
Vendor Advisory

Jump to

Vulnerability Details : CVE-2013-4761

Products affected by CVE-2013-4761

Exploit prediction scoring system (EPSS) score for CVE-2013-4761

CVSS scores for CVE-2013-4761

References for CVE-2013-4761