GCVE - cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*

part: a version: 1.2.0 update: *

Vendor	Puppet (`056a1ba3-12b3-5ecf-a97f-ab3b403c7816`)
Product	Puppet Enterprise (`f0f1d1ad-3d9e-59c3-8dee-09d0423ff49c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/puppetlabs/puppet`	purl2cpe	2026-06-01 10:14:37.329914

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4963`	vulnerable	2026-06-08 05:04:50.357470	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a (1) report, (2) group, or (3) class or possibly have other unspecified impact. Published: 2014-03-14T16:00:00.000Z Updated: 2024-08-06T16:59:41.266Z Open on db.gcve.eu Reference links http://puppetlabs.com/security/cve/cve-2013-4963	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-3567`	vulnerable	2026-06-08 05:04:32.056982	Details available Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call. Published: 2013-08-19T23:00:00.000Z Updated: 2024-08-06T16:14:56.276Z Open on db.gcve.eu Reference links http://secunia.com/advisories/54429 http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html http://www.debian.org/security/2013/dsa-2715 http://www.ubuntu.com/usn/USN-1886-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2274`	vulnerable	2026-06-08 05:04:24.291921	Details available Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report. Published: 2013-03-20T16:00:00.000Z Updated: 2024-08-06T15:27:41.143Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html http://www.debian.org/security/2013/dsa-2643 http://www.securityfocus.com/bid/58447 https://puppetlabs.com/security/cve/cve-2013-2274/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1989`	vulnerable	2026-06-08 05:00:52.197400	Details available telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log). Published: 2012-06-27T18:00:00.000Z Updated: 2024-08-06T19:17:27.600Z Open on db.gcve.eu Reference links http://projects.puppetlabs.com/issues/13606 http://ubuntu.com/usn/usn-1419-1 http://puppetlabs.com/security/cve/cve-2012-1989/ http://secunia.com/advisories/48743 https://exchange.xforce.ibmcloud.com/vulnerabilities/74797	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1987`	vulnerable	2026-06-08 05:00:52.183340	Details available Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations. Published: 2012-05-29T20:00:00.000Z Updated: 2024-08-06T19:17:27.604Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/74794 http://puppetlabs.com/security/cve/cve-2012-1987/ http://projects.puppetlabs.com/issues/13552 http://ubuntu.com/usn/usn-1419-1 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1986`	vulnerable	2026-06-08 05:00:52.182034	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1906`	vulnerable	2026-06-08 05:00:51.319583	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1054`	vulnerable	2026-06-08 05:00:47.267400	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1053`	vulnerable	2026-06-08 05:00:47.260590	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0891`	vulnerable	2026-06-08 05:00:46.287170	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3872`	vulnerable	2026-06-08 04:59:28.228471	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.