VulnerabilityModified

CVE-2013-1653

Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote…

HIGH 7.1EPSS 5.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.1 HIGHAV:N/AC:H/Au:S/C:C/I:C/A:C
EPSS: 5.38% probability · 92th percentile
CISA KEV: Not listed
Affected: puppet/puppet · puppetlabs/puppet · puppet/puppet enterprise · canonical/ubuntu linux
Source: cve@mitre.org

References

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlThird Party Advisory
http://secunia.com/advisories/52596Third Party Advisory
http://ubuntu.com/usn/usn-1759-1Third Party Advisory
http://www.debian.org/security/2013/dsa-2643Third Party Advisory
http://www.securityfocus.com/bid/58446Third Party Advisory, VDB Entry
https://puppetlabs.com/security/cve/cve-2013-1653/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlThird Party Advisory
http://secunia.com/advisories/52596Third Party Advisory
http://ubuntu.com/usn/usn-1759-1Third Party Advisory
http://www.debian.org/security/2013/dsa-2643Third Party Advisory
http://www.securityfocus.com/bid/58446Third Party Advisory, VDB Entry
https://puppetlabs.com/security/cve/cve-2013-1653/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.