CVE-2013-4959

LowCVSS 2.1/10Last modified Jun 16, 2026

Description

Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow local users to obtain sensitive information such as (1) host name, (2) MAC address, and (3) SSH keys via the web browser cache.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Aug 20, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-49615.0Puppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger products in its HTTP response headers, whicCVE-2013-49625.8The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify useCVE-2013-49636.8Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the autheCVE-2013-49645.0Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attCVE-2013-49655.0Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier CVE-2013-49666.4The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remoCVE-2013-49675.0Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded asCVE-2013-49686.1Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, aCVE-2013-49692.1Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrCVE-2013-49715.0Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sCVE-2013-49739.3Stack-based buffer overflow in RealNetworks RealPlayer before 16.0.3.51, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to exeCVE-2013-49749.3RealNetworks RealPlayer before 16.0.3.51, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code or cause a
CVE-2013-4959: Low severity, CVSS 2.1 | Vulnix