CVE-2013-2716 | BDVDB-2026-55338 Detail

Description#

Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://exchange.xforce.ibmcloud.com/vulnerabilities/83171
http://secunia.com/advisories/52862
https://puppetlabs.com/security/cve/cve-2013-2716/

Exploit#

No public exploit known

History#

Version 12013-04-10Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.