CVE-2013-4962

First published: Tue Aug 20 2013(Updated: )

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors.

Credit: cve@mitre.org

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/references
• agent/weakness
• agent/severity
• agent/author
• agent/type
• agent/event
• agent/last-modified-date
• agent/softwarecombine
• agent/first-publish-date
• agent/tags
• agent/description
• collector/mitre-cve
• source/MITRE
• vendor/puppet
• canonical/puppet puppet enterprise
• version/puppet puppet enterprise/3.0.0
• version/puppet puppet enterprise/2.5.1
• version/puppet puppet enterprise/2.5.2
• version/puppet puppet enterprise/2.8.0
• version/puppet puppet enterprise/2.8.1
• version/puppet puppet enterprise/2.8.2
• version/puppet puppet enterprise/2.8.3