CVE-2013-4958

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unattended workstation.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-49592.1Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow locaCVE-2013-49615.0Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, whicCVE-2013-49625.8The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify useCVE-2013-49636.8Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the autheCVE-2013-49645.0Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attCVE-2013-49655.0Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier CVE-2013-49666.4The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remoCVE-2013-49675.0Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded asCVE-2013-49686.1Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, aCVE-2013-49692.1Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrCVE-2013-49715.0Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sCVE-2013-49739.3Stack-based buffer overflow in RealNetworks RealPlayer before 16.0.3.51, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to exe
CVE-2013-4958: Medium severity, CVSS 6.9 | Vulnix