First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2013-4957

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Oct 25, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-49586.9Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unatt CVE-2013-49592.1Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow loca CVE-2013-49615.0Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, whic CVE-2013-49625.8The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify use CVE-2013-49636.8Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authe CVE-2013-49645.0Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote att CVE-2013-49655.0Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier CVE-2013-49666.4The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remo CVE-2013-49675.0Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as CVE-2013-49686.1Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, a CVE-2013-49692.1Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitr CVE-2013-49715.0Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain s

CVE-2013-4957: Medium severity, CVSS 6.8 | Vulnix