CVE-2013-4962

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

The reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current password, which allows attackers to modify user passwords by leveraging session hijacking, an unattended workstation, or other vectors.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:N/I:P/A:P

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://puppetlabs.com/security/cve/cve-2013-4962/Vendor Advisory
http://puppetlabs.com/security/cve/cve-2013-4962/Vendor Advisory

Timeline

Published: Aug 20, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-49636.8Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authe CVE-2013-49645.0Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote att CVE-2013-49655.0Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier CVE-2013-49666.4The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remo CVE-2013-49675.0Puppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via vectors related to how the password is "seeded as CVE-2013-49686.1Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, a CVE-2013-49692.1Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitr CVE-2013-49715.0Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain s CVE-2013-49739.3Stack-based buffer overflow in RealNetworks RealPlayer before 16.0.3.51, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to exe CVE-2013-49749.3RealNetworks RealPlayer before 16.0.3.51, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code or cause a CVE-2013-49758.8Hikvision DS-2CD7153-E IP Camera has Privilege Escalation CVE-2013-49769.8Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials