CVE-2013-2274

Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
http://rhn.redhat.com/errata/RHSA-2013-0710.html
http://secunia.com/advisories/52596	Vendor Advisory
http://www.debian.org/security/2013/dsa-2643
http://www.securityfocus.com/bid/58447
https://puppetlabs.com/security/cve/cve-2013-2274/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:puppet:puppet:2.6.0:::::::*
	cpe:2.3:a:puppet:puppet:2.6.1:::::::*
	cpe:2.3:a:puppet:puppet:2.6.2:::::::*
	cpe:2.3:a:puppet:puppet:2.6.3:::::::*
	cpe:2.3:a:puppet:puppet:2.6.4:::::::*
	cpe:2.3:a:puppet:puppet:2.6.5:::::::*
	cpe:2.3:a:puppet:puppet:2.6.6:::::::*
	cpe:2.3:a:puppet:puppet:2.6.7:::::::*
	cpe:2.3:a:puppet:puppet:2.6.8:::::::*
	cpe:2.3:a:puppet:puppet:2.6.9:::::::*
	cpe:2.3:a:puppet:puppet:2.6.10:::::::*
	cpe:2.3:a:puppet:puppet:2.6.11:::::::*
	cpe:2.3:a:puppet:puppet:2.6.12:::::::*
	cpe:2.3:a:puppet:puppet:2.6.13:::::::*
	cpe:2.3:a:puppet:puppet:2.6.14:::::::*
	cpe:2.3:a:puppet:puppet:2.6.15:::::::*
	cpe:2.3:a:puppet:puppet:2.6.16:::::::*
	cpe:2.3:a:puppetlabs:puppet:2.6.17:::::::*

Configuration 2 (hide)

cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-03-20 16:55

Updated : 2024-02-04 18:16

NVD link : CVE-2013-2274

Mitre link : CVE-2013-2274

CVE.ORG link : CVE-2013-2274

JSON object : View

Products Affected

puppet

puppet_enterprise
puppet

puppetlabs

puppet

CWE

NVD-CWE-noinfo

{"id": "CVE-2013-2274", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-03-20T16:55:01.827", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html", "source": "cve@mitre.org"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/52596", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2013/dsa-2643", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/58447", "source": "cve@mitre.org"}, {"url": "https://puppetlabs.com/security/cve/cve-2013-2274/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report."}, {"lang": "es", "value": "Puppet v2.6.x anterior a v2.6.18 y Puppet Enterprise v1.2.x anterior a v1.2.7 permite a usuarios remotos autenticados ejecutar c\u00f3digo arbitrario en el puppet master, o un agente con puppet kick habilitado, mediante una petici\u00f3n espcialmente dies\u00f1ada para un report."}], "lastModified": "2019-07-10T18:02:15.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6"}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04B6142C-AFC5-4045-8FA1-C07F2BEF487C"}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:2.6.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AED05EE-5038-4F3E-B4C2-4926CAE4A9BE"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}