Puppet Enterprise CVE-2013-4762 Session Hijacking Vulnerability

Bugtraq ID:	61857
Class:	Access Validation Error
CVE:	CVE-2013-4762
Remote:	Yes
Local:	No
Published:	Aug 15 2013 12:00AM
Updated:	Aug 15 2013 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Puppetlabs Puppet Enterprise 3.0 Puppetlabs Puppet Enterprise 2.8.3 Puppetlabs Puppet Enterprise 2.8.2 Puppetlabs Puppet Enterprise 2.7.2 Puppetlabs Puppet Enterprise 2.7.1 Puppetlabs Puppet Enterprise 2.7 Puppetlabs Puppet Enterprise 2.5.2 Puppetlabs Puppet Enterprise 2.5.1 Puppetlabs Puppet Enterprise 2.0.3 Puppetlabs Puppet Enterprise 2.0.2 Puppetlabs Puppet Enterprise 1.2.7 Puppetlabs Puppet Enterprise 2.8.0 Puppetlabs Puppet Enterprise 2.6 Puppetlabs Puppet Enterprise 1.2 Puppetlabs Puppet Enterprise 1.2 Puppetlabs Puppet Enterprise 1.1 Puppetlabs Puppet Enterprise 1.0 Puppetlabs Puppet Enterprise 2.0
Not Vulnerable:	Puppetlabs Puppet Enterprise 3.0.1

Puppet Enterprise CVE-2013-4762 Session Hijacking Vulnerability

Puppet is prone to a session-hijacking vulnerability.

Successful exploits may allow an attacker to gain unauthorized access to the affected application.

Versions prior to Puppet Enterprise 3.0.1 are vulnerable.

Puppet Enterprise CVE-2013-4762 Session Hijacking Vulnerability

An attacker can exploit this issue using readily available tools.

Puppet Enterprise CVE-2013-4762 Session Hijacking Vulnerability

References:

• CVE-2013-4762 (Logout Link Did Not Destroy Server Session) (Puppet Labs)
  
• Puppet Homepage (Puppet Labs)