CVE-2013-4957

2013-10-2523:55:04

CWE-94

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

High

EPSS

0.004

Percentile

74.6%

JSON

The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type.

Affected configurations

Nvd

Node

puppetpuppet_enterpriseRange≤3.0.0

puppetpuppet_enterpriseMatch2.5.1

puppetpuppet_enterpriseMatch2.5.2

puppetpuppet_enterpriseMatch2.8.0

puppetpuppet_enterpriseMatch2.8.1

puppetpuppet_enterpriseMatch2.8.2

puppetpuppet_enterpriseMatch2.8.3

VendorProductVersionCPE
puppetpuppet_enterprise*cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*
puppetpuppet_enterprise2.5.1cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*
puppetpuppet_enterprise2.5.2cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.0cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.1cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.2cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.3cpe:2.3:a:puppet:puppet_enterprise:2.8.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
puppet	puppet_enterprise	*	cpe:2.3:a:puppet:puppet_enterprise::::::::
puppet	puppet_enterprise	2.5.1	cpe:2.3:a:puppet:puppet_enterprise:2.5.1:::::::*
puppet	puppet_enterprise	2.5.2	cpe:2.3:a:puppet:puppet_enterprise:2.5.2:::::::*
puppet	puppet_enterprise	2.8.0	cpe:2.3:a:puppet:puppet_enterprise:2.8.0:::::::*
puppet	puppet_enterprise	2.8.1	cpe:2.3:a:puppet:puppet_enterprise:2.8.1:::::::*
puppet	puppet_enterprise	2.8.2	cpe:2.3:a:puppet:puppet_enterprise:2.8.2:::::::*
puppet	puppet_enterprise	2.8.3	cpe:2.3:a:puppet:puppet_enterprise:2.8.3:::::::*