CVE-2013-2716: Medium severity puppet enterprise vulnerability
Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (casclientconfig.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2716?
CVE-2013-2716 is considered a high severity vulnerability due to its potential to allow unauthorized console access.
How do I fix CVE-2013-2716?
To fix CVE-2013-2716, upgrade to Puppet Enterprise version 2.8.0 or later.
What causes CVE-2013-2716?
CVE-2013-2716 is caused by the lack of a randomized secret in the CAS client configuration when upgrading from older versions.
Which versions of Puppet Enterprise are affected by CVE-2013-2716?
Puppet Enterprise versions prior to 2.8.0, including 1.2.x, 2.0.x, up to 2.7.2, are affected by CVE-2013-2716.
Can CVE-2013-2716 be exploited remotely?
Yes, CVE-2013-2716 can be exploited remotely by using a crafted cookie to gain console access.