CVE-2013-1653

Published: Mar 20, 2013Modified: Apr 29, 2026

7.1

Vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.

Affected (37)

Products: Puppet: Puppet, Puppet Enterprise · Puppetlabs: Puppet · Canonical: Ubuntu Linux

2 products

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet	From 2.6.0 to 2.6.17

Configuration B

21 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet	Version 2.7.10
Puppet Puppet	Version 2.7.11
Puppet Puppet	Version 2.7.12
Puppet Puppet	Version 2.7.13
Puppet Puppet	Version 2.7.14
Puppet Puppet	Version 2.7.16
Puppet Puppet	Version 2.7.17
Puppet Puppet	Version 2.7.18
Puppet Puppet	Version 2.7.2
Puppet Puppet	Version 2.7.3
Puppet Puppet	Version 2.7.4
Puppet Puppet	Version 2.7.5
Puppet Puppet	Version 2.7.6
Puppet Puppet	Version 2.7.7
Puppet Puppet	Version 2.7.8
Puppet Puppet	Version 2.7.9
Puppetlabs Puppet	Version 2.7.0
Puppetlabs Puppet	Version 2.7.19
Puppetlabs Puppet	Version 2.7.1
Puppetlabs Puppet	Version 2.7.20
Puppetlabs Puppet	Version 2.7.20 rc1

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet Enterprise	Version 3.1.0

Configuration D

9 vulnerable

Vulnerable Software	Affected Versions
Puppetlabs Puppet	Version 1.0
Puppetlabs Puppet	Version 1.1
Puppetlabs Puppet	Version 1.2.0
Puppetlabs Puppet	Version 1.2.1
Puppetlabs Puppet	Version 1.2.2
Puppetlabs Puppet	Version 1.2.3
Puppetlabs Puppet	Version 1.2.4
Puppetlabs Puppet	Version 1.2.5
Puppetlabs Puppet	Version 1.2.6