CVE-2013-4963

Опубликовано: 14 мар. 2014

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a (1) report, (2) group, or (3) class or possibly have other unspecified impact.

Ссылки

http://puppetlabs.com/security/cve/cve-2013-4963
Vendor Advisory
http://puppetlabs.com/security/cve/cve-2013-4963
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*

Версия до 3.0.0 (включая)

cpe:2.3:a:puppet:puppet_enterprise:1.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:1.1:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*

cpe:2.3:a:puppet:puppet_enterprise:2.8.3:*:*:*:*:*:*:*

EPSS

Процентиль: 31%

0.00116

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2013-4963

debian

почти 12 лет назад

Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet E ...

GHSA-j575-87fh-mgcw

github

больше 3 лет назад