CVE-2013-4967

Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the lack of access control for /nodes.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2013-08-20

Last modified

2024-09-17

Weaknesses

CWE-255

Affected products

• Puppet Enterprise (Puppet)

References

• http://puppetlabs.com/security/cve/cve-2013-4967