CVE-2013-3567

2013-08-1923:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2013-3567

puppet

yaml

remote code execution

nvd

security vulnerability

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.223 Low

EPSS

Percentile

96.5%

JSON

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

CPENameOperatorVersion
puppetlabs:puppetpuppetlabs puppeteq2.7.0
puppetlabs:puppetpuppetlabs puppeteq3.2.0
puppetlabs:puppetpuppetlabs puppeteq2.7.1
puppetlabs:puppetpuppetlabs puppeteq2.7.20
puppetlabs:puppetpuppetlabs puppeteq2.7.19
puppet:puppetpuppeteq2.7.2
puppet:puppetpuppeteq2.7.10
puppet:puppetpuppeteq2.7.11
puppet:puppetpuppeteq2.7.12
puppet:puppetpuppeteq2.7.13

CPE	Name	Operator	Version
puppetlabs:puppet	puppetlabs puppet	eq	2.7.0
puppetlabs:puppet	puppetlabs puppet	eq	3.2.0
puppetlabs:puppet	puppetlabs puppet	eq	2.7.1
puppetlabs:puppet	puppetlabs puppet	eq	2.7.20
puppetlabs:puppet	puppetlabs puppet	eq	2.7.19
puppet:puppet	puppet	eq	2.7.2
puppet:puppet	puppet	eq	2.7.10
puppet:puppet	puppet	eq	2.7.11
puppet:puppet	puppet	eq	2.7.12
puppet:puppet	puppet	eq	2.7.13