CVEvulnerability
CVE-2013-1399
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-03-14
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Affected configurations
• puppet puppet enterprise (<= 2.7.0)
• puppet puppet enterprise 2.0.0
• puppet puppet enterprise 2.5.1
• puppet puppet enterprise 2.5.2
• puppetlabs puppet 2.5.0
• puppetlabs puppet 2.6.0
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://puppetlabs.com/security/cve/cve-2013-1399 Vendor Advisory
- https://puppetlabs.com/security/cve/cve-2013-1399 Vendor Advisory