Permissions, Privileges, and Access Controls in Puppet Enterprise - CVE-2013-4964
Published: August 21, 2013 / Updated: August 10, 2020
Vulnerability identifier: #VU42650
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4964
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Affected software
Puppet Enterprise
How to mitigate CVE-2013-4964
Install update from vendor's website.