What’s Vulnerable › Vulnerabilities

CVE-2013-4967

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-08-20 · updated 2026-06-16
• Weakness: CWE-255

Description

Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as a console parameter," External Node Classifiers, and the lack of access control for /nodes.

Affected products

• Puppet Enterprise: through 3.0.0; 2.5.1, 2.5.2, 2.8.0, 2.8.1, 2.8.2, 2.8.3

References

• http://puppetlabs.com/security/cve/cve-2013-4967
• http://puppetlabs.com/security/cve/cve-2013-4967

Get alerted when CVE-2013-4967 or the next vulnerability affects your stack