CVEvulnerability
CVE-2013-4962
5.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-08-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-255
Description
The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors.
Affected configurations
• puppet puppet enterprise (<= 3.0.0)
• puppet puppet enterprise 2.5.1
• puppet puppet enterprise 2.5.2
• puppet puppet enterprise 2.8.0
• puppet puppet enterprise 2.8.1
• puppet puppet enterprise 2.8.2
• puppet puppet enterprise 2.8.3
Related
Weakness · not in database (1)
References
- http://puppetlabs.com/security/cve/cve-2013-4962/ Vendor Advisory
- http://puppetlabs.com/security/cve/cve-2013-4962/ Vendor Advisory