Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

puppet puppet enterprise 2.8.1 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2013-4957
The dashboard report in Puppet Enterprise prior to 3.0.1 allows malicious users to execute arbitrary YAML code via a crafted report-specific type.
Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.5.2Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.5.1
NA
CVE-2013-4959
Puppet Enterprise prior to 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow local users to obtain sensitive information such as (1) host name, (2) MAC address, and (3) SSH keys via the web browser cache.
Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.5.2Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.5.1
NA
CVE-2013-4961
Puppet Enterprise prior to 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, which allows remote malicious users to obtain sensitive information.
Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.5.1Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.5.2
NA
CVE-2013-4964
Puppet Enterprise prior to 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote malicious users to capture this cookie by intercepting its transmission within an http session.
Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.5.1Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.5.2
NA
CVE-2013-4762
Puppet Enterprise prior to 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote malicious users to hijack sessions by obtaining an old session ID.
Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.5.2Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.5.1
NA
CVE-2013-4955
Open redirect vulnerability in the login page in Puppet Enterprise prior to 3.0.1 allows remote malicious users to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the service parameter.
Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.5.1Puppet Puppet Enterprise 2.5.2
NA
CVE-2013-4958
Puppet Enterprise prior to 3.0.1 does not use a session timeout, which makes it easier for malicious users to gain privileges by leveraging an unattended workstation.
Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.5.1Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.5.2
NA
CVE-2013-4962
The reset password page in Puppet Enterprise prior to 3.0.1 does not force entry of the current password, which allows malicious users to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors.
Puppet Puppet Enterprise 2.5.1Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.5.2Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.0
NA
CVE-2013-4967
Puppet Enterprise prior to 3.0.1 allows remote malicious users to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the lack of access control for /nodes.
Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.5.2Puppet Puppet EnterprisePuppet Puppet Enterprise 2.8.3Puppet Puppet Enterprise 2.5.1
NA
CVE-2014-3249
Puppet Enterprise 2.8.x prior to 2.8.7 allows remote malicious users to obtain sensitive information via vectors involving hiding and unhiding nodes.
Puppet Puppet Enterprise 2.8.5Puppet Puppet Enterprise 2.8.6Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.8.4Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.8.3
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook