1. Home
  2. CVE Database
  3. CVE-2013-4967
MEDIUM · 5.0

CVE-2013-4967

Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the la...

Vulnerability Description

Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the lack of access control for /nodes.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N
Confidentiality
PARTIAL
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
PuppetPuppet Enterprise<= 3.0.0

Related Weaknesses (CWE)

CWE-255

References

FAQ

What is CVE-2013-4967?

CVE-2013-4967 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the la...

How severe is CVE-2013-4967?

CVE-2013-4967 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-4967?

Check the references section above for vendor advisories and patch information. Affected products include: Puppet Puppet Enterprise.