CVE-2013-4969

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3...

2.1 LowFix available

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Exploit likelihood

0.43%Down 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 2.1

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: CVE-2013-4969
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: CVE-2013-4969
Updated: 2026-11-02

EUVDEUVD-2013-4813 No score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: EUVD-2013-4813
Updated: 2026-11-03

GitHub AdvisoriesGHSA-73jw-pjcv-9rgm No score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3...

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: GHSA-73jw-pjcv-9rgm
Weakness: CWE-59
Updated: 2026-11-02

OSVAZL-45426 No score

CVE-2013-4969 affecting package puppet 7.34.0-1

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: AZL-45426
Updated: 2026-11-02

OSV No score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: CVE-2013-4969
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-4969 No score

Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.

Record: DEBIAN-CVE-2013-4969
Updated: 2026-11-02

OSVMGASA-2014-0084 No score

Updated puppet & puppet3 packages fix CVE-2013-4969 and a regression

Updated puppet and puppet3 packages fix security vulnerability:

An unsafe use of temporary files was discovered in Puppet, a tool for centralized configuration management. An attacker can exploit this vulnerability and overwrite an arbitrary file in the system (CVE-2013-4969).

This update also corrects an upstream regression, see references for details.

Record: MGASA-2014-0084
Updated: 2026-11-02

OSVSUSE-RU-2015:0696-1 No score

Security update for puppet

Puppet was updated to fix the following security issues:

* Unsafe use of temporary files. (CVE-2013-4969)
* Arbitrary code execution with required social engineering.
  (CVE-2014-3248, CVE-2014-3250)

Security Issues references:

* CVE-2014-3248
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3248>
* CVE-2013-4969
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4969>
* CVE-2014-3250
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3250>

Record: SUSE-RU-2015:0696-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`puppet` Azure Linux:3	through 7.34.0-1	None known
`puppet` Debian:11	before 3.4.1-1	3.4.1-1
`puppet` Debian:6.0	before 2.6.2-5+squeeze9, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze4 Show 4 moreShow less 2.6.2-5+squeeze52.6.2-5+squeeze62.6.2-5+squeeze72.6.2-5+squeeze8	2.6.2-5+squeeze9
`puppet` Debian:7	before 2.7.23-1~deb7u2, plus listed versions 2.7.18-42.7.18-52.7.23-1~deb7u1	2.7.23-1~deb7u2
`puppet` Mageia:3	before 2.7.23-1.2.mga3	2.7.23-1.2.mga3
`puppet3` Mageia:3	before 3.2.4-1.2.mga3	3.2.4-1.2.mga3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4969 is a low vulnerability (CVSS 2.1) in Puppet Enterprise, published December 31, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in puppet 3.4.1-1.

References

Show 20 moreShow less