Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2013-3567
HistoryAug 19, 2013 - 11:55 p.m.

CVE-2013-3567

2013-08-1923:55:08
CWE-20
[email protected]
web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 High

AI Score

Confidence

Low

0.223 Low

EPSS

Percentile

96.5%

JSON

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

Affected configurations

NVD
Node
puppetpuppetMatch2.7.2
OR
puppetpuppetMatch2.7.10
OR
puppetpuppetMatch2.7.11
OR
puppetpuppetMatch2.7.12
OR
puppetpuppetMatch2.7.13
OR
puppetpuppetMatch2.7.14
OR
puppetpuppetMatch2.7.16
OR
puppetpuppetMatch2.7.17
OR
puppetpuppetMatch2.7.18
OR
puppetpuppetMatch2.7.21
OR
puppetpuppetMatch3.2.1
OR
puppetlabspuppetMatch2.7.0
OR
puppetlabspuppetMatch2.7.1
OR
puppetlabspuppetMatch2.7.19
OR
puppetlabspuppetMatch2.7.20
OR
puppetlabspuppetMatch2.7.20rc1
OR
puppetlabspuppetMatch3.2.0
Node
canonicalubuntu_linuxMatch12.04-lts
OR
canonicalubuntu_linuxMatch12.10
OR
canonicalubuntu_linuxMatch13.04
Node
novellsuse_linux_enterprise_desktopMatch11sp3
OR
novellsuse_linux_enterprise_desktopMatch11.0sp2
OR
novellsuse_linux_enterprise_serverMatch11.0sp2vmware
OR
novellsuse_linux_enterprise_serverMatch11.0sp3
OR
novellsuse_linux_enterprise_serverMatch11.0sp3vmware
Node
puppetpuppet_enterpriseRange≤2.8.1
OR
puppetpuppet_enterpriseMatch1.0
OR
puppetpuppet_enterpriseMatch1.1
OR
puppetpuppet_enterpriseMatch1.2.0
OR
puppetpuppet_enterpriseMatch2.0.0
OR
puppetpuppet_enterpriseMatch2.5.1
OR
puppetpuppet_enterpriseMatch2.5.2
OR
puppetpuppet_enterpriseMatch2.8.0
OR
puppetlabspuppetMatch1.0.0-enterprise
OR
puppetlabspuppetMatch1.1.0-enterprise
OR
puppetlabspuppetMatch1.2.0-enterprise
OR
puppetlabspuppetMatch2.5.0-enterprise
OR
puppetlabspuppetMatch2.6.0-enterprise
OR
puppetlabspuppetMatch2.7.0-enterprise
OR
puppetlabspuppetMatch2.7.1-enterprise
OR
puppetlabspuppetMatch2.7.2-enterprise

Related

openvas 10
cvelist 1
nessus 10
securityvulns 1
amazon 1
cve 1
freebsd 1
suse 2
veracode 1
prion 1
ubuntu 1
mageia 1
osv 1
debian 1
ubuntucve 1
debiancve 1
github 1
redhat 2
gentoo 1
openvas
openvas
Ubuntu: Security Advisory (USN-1886-1)
2013-06-24 00:00:00
SUSE: Security Advisory (SUSE-SU-2013:1304-1)
2021-06-09 00:00:00
Mageia: Security Advisory (MGASA-2013-0187)
2022-01-28 00:00:00
cvelist
cvelist
CVE-2013-3567
2013-08-19 23:00:00
nessus
nessus
SuSE 11.2 / 11.3 Security Update : puppet / puppet, puppet-server (SAT Patch Numbers 8131 / 8132)
2013-08-07 00:00:00
FreeBSD : puppet -- Unauthenticated Remote Code Execution Vulnerability (b162b218-c547-4ba2-ae31-6fdcb61bc763)
2013-06-23 00:00:00
openSUSE Security Update : puppet (openSUSE-SU-2013:1370-1)
2014-06-13 00:00:00
securityvulns
securityvulns
puppet code exeuction
2013-07-01 00:00:00
amazon
amazon
Critical: puppet
2013-07-12 15:57:00
cve
cve
CVE-2013-3567
2013-08-19 23:55:08
freebsd
freebsd
puppet -- Unauthenticated Remote Code Execution Vulnerability
2013-06-13 00:00:00
suse
suse
puppet: security fix for YAML support (critical)
2013-08-22 15:04:10
Security update for puppet (critical)
2013-08-06 20:04:12
veracode
veracode
Arbitrary Code Execution Through REST API Call
2019-01-15 08:59:44
prion
prion
Improper access control
2013-08-19 23:55:00
ubuntu
ubuntu
Puppet vulnerability
2013-06-18 00:00:00
mageia
mageia
Updated puppet packages fix remote code execution vulnerability
2013-06-26 22:36:33
osv
osv
Puppet Improper Input Validation vulnerability
2017-10-24 18:33:37
debian
debian
[SECURITY] [DSA 2715-1] puppet security update
2013-06-26 20:24:35
ubuntucve
ubuntucve
CVE-2013-3567
2013-06-18 00:00:00
debiancve
debiancve
CVE-2013-3567
2013-08-19 23:55:08
github
github
Puppet Improper Input Validation vulnerability
2017-10-24 18:33:37
redhat
redhat
(RHSA-2013:1283) Moderate: puppet security update
2013-09-24 00:00:00
(RHSA-2013:1284) Critical: ruby193-puppet security update
2013-09-24 00:00:00
gentoo
gentoo
Puppet: Multiple vulnerabilities
2013-08-23 00:00:00

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 High

AI Score

Confidence

Low

0.223 Low

EPSS

Percentile

96.5%

JSON
Related for NVD:CVE-2013-3567
openvas10cvelist1nessus10securityvulns1amazon1cve1freebsd1suse2veracode1prion1ubuntu1mageia1osv1debian1ubuntucve1debiancve1github1redhat2gentoo1