CVE-2013-4962: Medium severity puppet Puppet Enterprise vulnerability
The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4962?
CVE-2013-4962 has been assigned a medium severity rating due to the potential for attackers to reset user passwords.
How do I fix CVE-2013-4962?
To fix CVE-2013-4962, upgrade to Puppet Enterprise version 3.0.1 or later, where the vulnerability has been addressed.
What impact does CVE-2013-4962 have on security?
CVE-2013-4962 allows attackers to change user passwords without needing the current password, which can lead to unauthorized access.
Which versions of Puppet Enterprise are affected by CVE-2013-4962?
Puppet Enterprise versions prior to 3.0.1, specifically versions 2.5.1, 2.5.2, 2.8.0, 2.8.1, 2.8.2, and 2.8.3 are affected by CVE-2013-4962.
What types of attacks could exploit CVE-2013-4962?
CVE-2013-4962 could be exploited through session hijacking, accessing an unattended workstation, or similar vectors.