CVE-2013-4969

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3...

2.1 LowFix available

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Exploit likelihood

0.43%Down 0.5 points since Feb 4, 2022

What each source reports

NVD Score used2.1

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: CVE-2013-4969
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-59
Updated: 2026-11-02

CVE ListNo score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: CVE-2013-4969
Updated: 2026-11-02

EUVDEUVD-2013-4813No score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: EUVD-2013-4813
Updated: 2026-11-03

GitHub AdvisoriesGHSA-73jw-pjcv-9rgmNo score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3...

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: GHSA-73jw-pjcv-9rgm
Weakness: CWE-59
Updated: 2026-11-02

OSVAZL-45426No score

CVE-2013-4969 affecting package puppet 7.34.0-1

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: AZL-45426
Updated: 2026-11-05

OSVNo score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: CVE-2013-4969
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-4969No score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: DEBIAN-CVE-2013-4969
Updated: 2026-11-02

OSVMGASA-2014-0084No score

Updated puppet & puppet3 packages fix CVE-2013-4969 and a regression

Updated puppet and puppet3 packages fix security vulnerability:

An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system (CVE-2013-4969).

This update also corrects an upstream regression, see references for details.

Record: MGASA-2014-0084
Updated: 2026-11-02

OSVSUSE-RU-2015:0696-1No score

Security update for puppet

Puppet was updated to fix the following security issues:

* Unsafe use of temporary files. (CVE-2013-4969)
* Arbitrary code execution with required social engineering.
  (CVE-2014-3248, CVE-2014-3250)

Security Issues references:

* CVE-2014-3248
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3248>
* CVE-2013-4969
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4969>
* CVE-2014-3250
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3250>

Record: SUSE-RU-2015:0696-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`puppet` Azure Linux:3	through 7.34.0-1	None known
`puppet` Debian:11	before 3.4.1-1	3.4.1-1
`puppet` Debian:6.0	before 2.6.2-5+squeeze9, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze4 Show 4 moreShow less 2.6.2-5+squeeze52.6.2-5+squeeze62.6.2-5+squeeze72.6.2-5+squeeze8	2.6.2-5+squeeze9
`puppet` Debian:7	before 2.7.23-1~deb7u2, plus listed versions 2.7.18-42.7.18-52.7.23-1~deb7u1	2.7.23-1~deb7u2
`puppet` Mageia:3	before 2.7.23-1.2.mga3	2.7.23-1.2.mga3
`puppet3` Mageia:3	before 3.2.4-1.2.mga3	3.2.4-1.2.mga3

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4969 is a low vulnerability (CVSS 2.1) in Puppet Enterprise, published December 31, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in puppet 3.4.1-1.

References

Show 20 moreShow less