CVE-2013-2716

Published: Apr 10, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.

Affected (9)

Products: Puppet: Puppet Enterprise · Puppetlabs: Puppet

1 product

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet Enterprise	Up to 2.7.2
Puppet Puppet Enterprise	Version 2.0.0
Puppet Puppet Enterprise	Version 2.5.1
Puppet Puppet Enterprise	Version 2.5.2
Puppetlabs Puppet	Version 1.0.0
Puppetlabs Puppet	Version 1.1.0
Puppetlabs Puppet	Version 1.2.0
Puppetlabs Puppet	Version 2.5.0
Puppetlabs Puppet	Version 2.6.0