« Volver al listado

CVE-2013-4962

Estado: ModificadaMedia (5.8)—

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Puppet — Puppet Enterprise

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4962",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-20T22:55:04.527",
  "references": [
    {
      "url": "http://puppetlabs.com/security/cve/cve-2013-4962/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://puppetlabs.com/security/cve/cve-2013-4962/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-255"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors."
    },
    {
      "lang": "es",
      "value": "La pagina de restaurar contraseñas en Puppet Enterprise anterior a v3.0.1 no fuerza la entrada de la contraseña actual, lo que permite a los atacantes modificar las contraseñas de usuario mediante el aprovechamiento de secuestro de sesión, utilizando un equipo de trabajo sin supervisión, u otros vectores."
    }
  ],
  "lastModified": "2026-06-16T23:58:10.243",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "816D363E-4782-4977-9E52-94189E0AEB60",
              "versionEndIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32A5E42D-9626-4FC8-A032-4CD4FA1255BF"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06F0697C-A1BF-42FE-A036-F3E6FAB30A87"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C43CD3C-ACDB-418B-B67D-9C8EFAC0680C"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD8F80AD-1E8E-40BE-883D-6F7F61D4A274"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C6E27BB-6444-49E2-8B89-D7E09284D29C"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43841CE7-ECAC-43FE-935A-478EA413BDF1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}