CVE-2013-1398

Опубликовано: 14 мар. 2014

Источник: nvd

CVSS2: 8.5

EPSS Низкий

Описание

The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.

Ссылки

http://puppetlabs.com/security/cve/cve-2013-1398
Vendor Advisory
http://puppetlabs.com/security/cve/cve-2013-1398
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*

Версия до 2.7.0 (включая)

cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*

cpe:2.3:a:puppetlabs:puppet:2.5.0:-:enterprise:*:*:*:*:*

cpe:2.3:a:puppetlabs:puppet:2.6.0:-:enterprise:*:*:*:*:*

EPSS

Процентиль: 69%

0.00616

Низкий

8.5 High

CVSS2

Дефекты

CWE-310

Связанные уязвимости

CVE-2013-1398

debian

почти 12 лет назад

The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does ...

GHSA-frcj-xcfh-9j6w

github

больше 3 лет назад