CVE-2013-1399

Multiple cross-site request forgery CSRF vulnerabilities in the 1 node request management, 2 live management, and 3 user administration components in the console in Puppet Enterprise PE before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-5158

Removed by vendor...

CVE-2013-4963

Removed by vendor...

CVE-2013-1398

Removed by vendor...

CVE-2013-1398

The pemcollective module in Puppet Enterprise PE before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role...

CVE-2013-4963

Multiple cross-site request forgery CSRF vulnerabilities in Puppet Enterprise PE before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a 1 report, 2 group, or 3 class or possibly have other unspecified impact...

CVE-2013-4963

Puppet Enterprise before 3.0.1 is affected by multiple CSRF vulnerabilities that allow an attacker to hijack user authentication for actions such as deleting a report, group, or class. The CVE-2013-4963 entry documents these issues, with the underlying impact being that an attacker could manipula...

CVE-2013-1399

Removed by vendor...

CVE-2012-5158

Puppet Enterprise 2.x prior to 2.6.1 is affected by a session-handling weakness: when the session secret changes, sessions are not properly invalidated, allowing an authenticated remote user to retain access via unspecified vectors. Affected component is the PE 2.x session management; root cause ...

CVE-2013-4966

The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console...

CVE-2013-4971

Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors...

Design/Logic Flaw

The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console...

CVE-2013-4971

Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2013-4966

Puppet Enterprise before 3.2.0 is affected: the master external node classification script does not verify the identity of consoles, which allows remote attackers to spoof a console and create arbitrary classifications on the master. Affected: Puppet Enterprise 3.x prior to 3.2.0. Root cause: mis...

CVE-2013-4966

Removed by vendor...

CVE-2013-4971

Removed by vendor...

AZL-45426 CVE-2013-4969 affecting package puppet 7.34.0-1

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise PE before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files...

DEBIAN-CVE-2013-4969

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise PE before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files...

CVE-2013-4969

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise PE before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files...

Puppet/Puppet Enterprise不安全临时文件符号链接攻击漏洞

CVE ID:CVE-2013-4969 puppet是一款Linux、Unix、windows平台的集中配置管理系统。 Puppet和Puppet Enterprise使用不安全的临时文件，允许本地攻击者使用符号链接攻击覆盖系统任意文件。 0 Puppet 3.3.2 Puppet 3.4.0 Puppet 2.8.3 Puppet 3.1.0 puppet 2.8.4和3.1.1， puppet 3.3.3和3.4.1已经修复该漏洞，建议用户下载更新： http://puppetlabs.com/...