CSRF in Puppet Enterprise
CVE-2013-1399
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.006 (45.5th percentile) — read the EPSS interpretation.
Affected products
- Puppet Puppet_enterprise — versions 2.0.0, 2.5.1, 2.5.2
- Puppetlabs Puppet — versions 2.5.0, 2.6.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)