CVE-2013-1653

Опубликовано: 20 мар. 2013

Источник: nvd

CVSS2: 7.1

EPSS Низкий

Описание

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
Third Party Advisory
http://secunia.com/advisories/52596
Third Party Advisory
http://ubuntu.com/usn/usn-1759-1
Third Party Advisory
http://www.debian.org/security/2013/dsa-2643
Third Party Advisory
http://www.securityfocus.com/bid/58446
Third Party Advisory
VDB Entry
https://puppetlabs.com/security/cve/cve-2013-1653/
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
Third Party Advisory
http://secunia.com/advisories/52596
Third Party Advisory
http://ubuntu.com/usn/usn-1759-1
Third Party Advisory
http://www.debian.org/security/2013/dsa-2643
Third Party Advisory
http://www.securityfocus.com/bid/58446
Third Party Advisory
VDB Entry
https://puppetlabs.com/security/cve/cve-2013-1653/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*

Версия от 2.6.0 (включая) до 2.6.17 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*

cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*

cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*

cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*

cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*

cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:puppet:puppet_enterprise:3.1.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:puppetlabs:puppet:1.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:puppetlabs:puppet:1.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:puppetlabs:puppet:1.2.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:puppetlabs:puppet:1.2.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:puppetlabs:puppet:1.2.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:puppetlabs:puppet:1.2.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:puppetlabs:puppet:1.2.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:puppetlabs:puppet:1.2.5:*:*:*:enterprise:*:*:*

cpe:2.3:a:puppetlabs:puppet:1.2.6:*:*:*:enterprise:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:puppet:puppet_enterprise:2.7.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.7.1:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02231

Низкий

7.1 High

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2013-1653

ubuntu

почти 13 лет назад

CVE-2013-1653

debian

почти 13 лет назад

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and ...

GHSA-r53h-f365-v9hc

github

больше 3 лет назад

BDU:2015-09724

fstec

больше 12 лет назад

Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

EPSS

Процентиль: 84%

0.02231

Низкий

7.1 High

CVSS2

Дефекты

NVD-CWE-noinfo