CVE-2013-4961: Infoleak
Published Aug 20, 2013
·Updated
Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, which allows remote attackers to obtain sensitive information.
Affected Software
7 affected components
puppet Puppet Enterprise<=3.0.0
puppet Puppet Enterprise=2.5.1
puppet Puppet Enterprise=2.5.2
puppet Puppet Enterprise=2.8.0
puppet Puppet Enterprise=2.8.1
puppet Puppet Enterprise=2.8.2
puppet Puppet Enterprise=2.8.3
Event History
Aug 20, 2013
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4961?
CVE-2013-4961 is considered a medium severity vulnerability due to the potential exposure of sensitive information.
2
How do I fix CVE-2013-4961?
To fix CVE-2013-4961, upgrade Puppet Enterprise to version 3.0.1 or later.
3
What products are affected by CVE-2013-4961?
CVE-2013-4961 affects Puppet Enterprise versions 2.5.1, 2.5.2, 2.8.0, 2.8.1, 2.8.2, and 2.8.3, as well as all versions prior to 3.0.1.
4
What kind of information can be leaked by CVE-2013-4961?
CVE-2013-4961 can leak version information for Apache and Phusion Passenger in HTTP response headers.
5
Is CVE-2013-4961 exploitable remotely?
Yes, CVE-2013-4961 is exploitable remotely, allowing attackers to obtain sensitive information without authentication.