CVE-2013-4762

2013-08-2022:55:04

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.6

Confidence

Low

EPSS

0.003

Percentile

65.3%

JSON

Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session ID.

Affected configurations

Nvd

Node

puppetpuppet_enterpriseRange≤3.0.0

puppetpuppet_enterpriseMatch2.5.1

puppetpuppet_enterpriseMatch2.5.2

puppetpuppet_enterpriseMatch2.8.0

puppetpuppet_enterpriseMatch2.8.1

puppetpuppet_enterpriseMatch2.8.2

puppetpuppet_enterpriseMatch2.8.3

VendorProductVersionCPE
puppetpuppet_enterprise*cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*
puppetpuppet_enterprise2.5.1cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*
puppetpuppet_enterprise2.5.2cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.0cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.1cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.2cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*
puppetpuppet_enterprise2.8.3cpe:2.3:a:puppet:puppet_enterprise:2.8.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
puppet	puppet_enterprise	*	cpe:2.3:a:puppet:puppet_enterprise::::::::
puppet	puppet_enterprise	2.5.1	cpe:2.3:a:puppet:puppet_enterprise:2.5.1:::::::*
puppet	puppet_enterprise	2.5.2	cpe:2.3:a:puppet:puppet_enterprise:2.5.2:::::::*
puppet	puppet_enterprise	2.8.0	cpe:2.3:a:puppet:puppet_enterprise:2.8.0:::::::*
puppet	puppet_enterprise	2.8.1	cpe:2.3:a:puppet:puppet_enterprise:2.8.1:::::::*
puppet	puppet_enterprise	2.8.2	cpe:2.3:a:puppet:puppet_enterprise:2.8.2:::::::*
puppet	puppet_enterprise	2.8.3	cpe:2.3:a:puppet:puppet_enterprise:2.8.3:::::::*