Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-1653

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.

Published

2013-03-20T16:55:01.770

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.1 (HIGH)

CVSSv2 Vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: HIGH
Authentication: SINGLE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	puppet	puppet	≤ 2.6.17	Yes
Application	puppet	puppet	2.7.2	Yes
Application	puppet	puppet	2.7.3	Yes
Application	puppet	puppet	2.7.4	Yes
Application	puppet	puppet	2.7.5	Yes
Application	puppet	puppet	2.7.6	Yes
Application	puppet	puppet	2.7.7	Yes
Application	puppet	puppet	2.7.8	Yes
Application	puppet	puppet	2.7.9	Yes
Application	puppet	puppet	2.7.10	Yes
Application	puppet	puppet	2.7.11	Yes
Application	puppet	puppet	2.7.12	Yes
Application	puppet	puppet	2.7.13	Yes
Application	puppet	puppet	2.7.14	Yes
Application	puppet	puppet	2.7.16	Yes
Application	puppet	puppet	2.7.17	Yes
Application	puppet	puppet	2.7.18	Yes
Application	puppetlabs	puppet	2.7.0	Yes
Application	puppetlabs	puppet	2.7.1	Yes
Application	puppetlabs	puppet	2.7.19	Yes
Application	puppetlabs	puppet	2.7.20	Yes
Application	puppetlabs	puppet	2.7.20	Yes
Application	puppet	puppet_enterprise	3.1.0	Yes
Application	puppetlabs	puppet	1.0	Yes
Application	puppetlabs	puppet	1.1	Yes
Application	puppetlabs	puppet	1.2.0	Yes
Application	puppetlabs	puppet	1.2.1	Yes
Application	puppetlabs	puppet	1.2.2	Yes
Application	puppetlabs	puppet	1.2.3	Yes
Application	puppetlabs	puppet	1.2.4	Yes
Application	puppetlabs	puppet	1.2.5	Yes
Application	puppetlabs	puppet	1.2.6	Yes
Application	puppet	puppet_enterprise	2.7.0	Yes
Application	puppet	puppet_enterprise	2.7.1	Yes
Operating System	canonical	ubuntu_linux	11.10	Yes
Operating System	canonical	ubuntu_linux	12.04	Yes
Operating System	canonical	ubuntu_linux	12.10	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html Third Party Advisory ([email protected])
http://secunia.com/advisories/52596 Third Party Advisory ([email protected])
http://ubuntu.com/usn/usn-1759-1 Third Party Advisory ([email protected])
http://www.debian.org/security/2013/dsa-2643 Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/58446 Third Party Advisory, VDB Entry ([email protected])
https://puppetlabs.com/security/cve/cve-2013-1653/ Vendor Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/52596 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://ubuntu.com/usn/usn-1759-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2013/dsa-2643 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/58446 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://puppetlabs.com/security/cve/cve-2013-1653/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)