CVE-2023-5309

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published
Nov 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-530907.1In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix an illegal memory access In the kfd_wait_on_events() fCVE-2023-530915.5In the Linux kernel, the following vulnerability has been resolved: ext4: update s_journal_inum if it changes after journal replay When moCVE-2023-530925.5In the Linux kernel, the following vulnerability has been resolved: interconnect: exynos: fix node leak in probe PM QoS error path Make suCVE-2023-530935.5In the Linux kernel, the following vulnerability has been resolved: tracing: Do not let histogram values have some modifiers Histogram valCVE-2023-530944.7In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsl_lpuart: fix race on RX DMA shutdown From time to timeCVE-2023-530955.5In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix a NULL pointer dereference The LRU mechanism may look up CVE-2023-530965.5In the Linux kernel, the following vulnerability has been resolved: interconnect: fix mem leak when freeing nodes The node link array is aCVE-2023-530975.5In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: fix memory leak with using debugfs_lookup() When callinCVE-2023-530985.5In the Linux kernel, the following vulnerability has been resolved: media: rc: gpio-ir-recv: add remove function In case runtime PM is enaCVE-2023-530995.5In the Linux kernel, the following vulnerability has been resolved: firmware: xilinx: don't make a sleepable memory allocation from an atomCVE-2023-53106.5A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4CVE-2023-531005.5In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in ext4_update_inline_data Syzbot found the followin
CVE-2023-5309: Critical severity, CVSS 9.8 | Vulnix