« Back to list

CVE-2013-4961

Status: ModifiedMedium (5)—

Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, which allows remote attackers to obtain sensitive information.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Puppet — Puppet Enterprise

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2013-4961",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-20T22:55:04.503",
  "references": [
    {
      "url": "http://puppetlabs.com/security/cve/cve-2013-4961/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://puppetlabs.com/security/cve/cve-2013-4961/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, which allows remote attackers to obtain sensitive information."
    },
    {
      "lang": "es",
      "value": "Puppet Enterprise anterior a 3.0.1, incluye información de la versión para los productos Apache y Phusion Passenger en las cabeceras de respuesta HTTP, lo que permite a atacantes remotos la obtención de información sensible."
    }
  ],
  "lastModified": "2026-06-16T23:58:10.133",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "816D363E-4782-4977-9E52-94189E0AEB60",
              "versionEndIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32A5E42D-9626-4FC8-A032-4CD4FA1255BF"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06F0697C-A1BF-42FE-A036-F3E6FAB30A87"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C43CD3C-ACDB-418B-B67D-9C8EFAC0680C"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD8F80AD-1E8E-40BE-883D-6F7F61D4A274"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C6E27BB-6444-49E2-8B89-D7E09284D29C"
            },
            {
              "criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43841CE7-ECAC-43FE-935A-478EA413BDF1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}