CVE-2013-4958

2013-08-2022:55:04

CWE-287

[email protected]

web.nvd.nist.gov

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

30.9%

JSON

Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unattended workstation.

Affected configurations

Nvd

Node

puppetpuppet_enterpriseRange≤3.0.0

puppetpuppet_enterpriseMatch2.5.1

puppetpuppet_enterpriseMatch2.5.2

puppetpuppet_enterpriseMatch2.8.0

puppetpuppet_enterpriseMatch2.8.1

puppetpuppet_enterpriseMatch2.8.2

puppetpuppet_enterpriseMatch2.8.3

VendorProductVersionCPE
puppetpuppet_enterprise*cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*
puppetpuppet_enterprise2.5.1cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*
puppetpuppet_enterprise2.5.2cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.0cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.1cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.2cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.3cpe:2.3:a:puppet:puppet_enterprise:2.8.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
puppet	puppet_enterprise	*	cpe:2.3:a:puppet:puppet_enterprise::::::::
puppet	puppet_enterprise	2.5.1	cpe:2.3:a:puppet:puppet_enterprise:2.5.1:::::::*
puppet	puppet_enterprise	2.5.2	cpe:2.3:a:puppet:puppet_enterprise:2.5.2:::::::*
puppet	puppet_enterprise	2.8.0	cpe:2.3:a:puppet:puppet_enterprise:2.8.0:::::::*
puppet	puppet_enterprise	2.8.1	cpe:2.3:a:puppet:puppet_enterprise:2.8.1:::::::*
puppet	puppet_enterprise	2.8.2	cpe:2.3:a:puppet:puppet_enterprise:2.8.2:::::::*
puppet	puppet_enterprise	2.8.3	cpe:2.3:a:puppet:puppet_enterprise:2.8.3:::::::*