CVE-2013-4968

Published: 11 December 2019

Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cross-site scripting (XSS) attacks via unspecified vectors related to "live management."

Notes

Author	Note
sbeattie	affects Puppet Enterprise only

Priority

Cvss 3 Severity Score

6.1

Score breakdown

Status

Package	Release	Status
puppet Launchpad, Ubuntu, Debian	precise	Not vulnerable (Puppet Enterprise only)
	trusty	Not vulnerable (Puppet Enterprise only)
	upstream	Not vulnerable (Puppet Enterprise only)
	vivid	Not vulnerable (Puppet Enterprise only)

Severity score breakdown

Parameter	Value
Base score	6.1
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Changed
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›