CVE-2013-4967

Published: 20 August 2013

Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the lack of access control for /nodes.

Notes

Puppet Enterprise is affected, not puppet

Status

References

• http://puppetlabs.com/security/cve/cve-2013-4967
• https://www.cve.org/CVERecord?id=CVE-2013-4967
• NVD
• Launchpad
• Debian