CVE-2013-2274
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated...
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
Exploit likelihood
What each source reports
NVD Score used
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
- Record
CVE-2013-2274- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
- Record
CVE-2013-2274- Updated
- 2026-11-02
EUVDEUVD-2013-2220 No score
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
- Record
EUVD-2013-2220- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8wjv-x2mj-6x2c No score
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated...
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
- Record
GHSA-8wjv-x2mj-6x2c- Updated
- 2026-11-02
OSV No score
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
- Record
CVE-2013-2274- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2274 No score
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
- Record
DEBIAN-CVE-2013-2274- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetDebian:11 |
before 2.7-1 | 2.7-1 |
puppetDebian:6.0 From an advisory covering 7 CVEs |
before 2.6.2-5+squeeze7, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze42.6.2-5+squeeze52.6.2-5+squeeze6 |
2.6.2-5+squeeze7 |
puppetRed Hat:openstack:2::el6 From an advisory covering 6 CVEs |
before 0:2.6.18-1.el6ost | 0:2.6.18-1.el6ost |
puppet-serverRed Hat:openstack:2::el6 From an advisory covering 6 CVEs |
before 0:2.6.18-1.el6ost | 0:2.6.18-1.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2274 is a medium vulnerability (CVSS 6.5) in Puppet, published March 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.91%, the 87th percentile. Fixed in puppet 2.7-1.
References
lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
rhn.redhat.com/errata/RHSA-2013-0710.html
debian.org/security/2013/dsa-2643
securityfocus.com/bid/58447
puppetlabs.com/security/cve/cve-2013-2274
secunia.com/advisories/52596
Show 31 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-2274
github.com/advisories/GHSA-8wjv-x2mj-6x2c
security-tracker.debian.org/tracker/CVE-2013-2274
access.redhat.com/errata/RHSA-2013:0710
bugzilla.redhat.com/show_bug.cgi?id=908629
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0710.json
cve.org/CVERecord?id=CVE-2012-6120