Every CVE Search/ Get API key

CVE-2013-4761

Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service

5.1 MediumFix available

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Exploit likelihood

1.64%Up 0.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.1

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Record
CVE-2013-4761
CVSS 2.0
5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Record
CVE-2013-4761
Updated
2026-11-02
EUVDEUVD-2017-0218 No score

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Record
EUVD-2017-0218
Updated
2026-11-03
GitHub AdvisoriesGHSA-cj43-9h3w-v976 No score

Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Record
GHSA-cj43-9h3w-v976
Updated
2026-11-02
OSV No score

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Record
CVE-2013-4761
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4761 No score

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Record
DEBIAN-CVE-2013-4761
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-cj43-9h3w-v976 No score

Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Record
GHSA-cj43-9h3w-v976
Updated
2026-11-02
OSVMGASA-2013-0259 No score

Updated puppet and puppet3 package fix security vulnerabilities

It was discovered that Puppet incorrectly handled the resource_type service. A local attacker on the master could use this issue to execute arbitrary Ruby files (CVE-2013-4761).

It was discovered that Puppet incorrectly handled permissions on the modules it installed. Modules could be installed with the permissions that existed when they were built, possibly exposing them to a local attacker (CVE-2013-4956).

Record
MGASA-2013-0259
Updated
2026-11-02
OSVopenSUSE-SU-2024:10581-1 No score

ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media

These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10581-1
Updated
2026-11-02
OSVSUSE-RU-2015:0696-1 No score

Security update for puppet

Puppet was updated to fix the following security issues:

* Unsafe use of temporary files. (CVE-2013-4969)
* Arbitrary code execution with required social engineering.
  (CVE-2014-3248, CVE-2014-3250)

Security Issues references:

* CVE-2014-3248
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3248>
* CVE-2013-4969
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4969>
* CVE-2014-3250
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3250>
Record
SUSE-RU-2015:0696-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
puppet
RubyGems
 2.7.0 up to 2.7.23
2.7.23
puppet
RubyGems
 3.2.0 up to 3.2.4
3.2.4
puppet
Debian:11
 before 3.2.4-1
3.2.4-1
puppet
Debian:7
 before 2.7.23-1~deb7u1, plus listed versions
2.7.18-42.7.18-5
2.7.23-1~deb7u1
puppet
RubyGems
 2.7.0 up to 2.7.23, plus listed versions
2.7.12.7.112.7.122.7.132.7.14
Show 14 moreShow less
2.7.162.7.172.7.182.7.192.7.202.7.20.rc12.7.212.7.222.7.32.7.42.7.52.7.62.7.82.7.9
2.7.23
puppet
RubyGems
 3.2.0 up to 3.2.4, plus listed versions
3.2.13.2.1.rc13.2.23.2.33.2.3.rc1
3.2.4
puppet
Mageia:2
 before 2.7.23-1.mga2
2.7.23-1.mga2
puppet
Mageia:3
 before 2.7.23-1.mga3
2.7.23-1.mga3
puppet3
Mageia:3
 before 3.2.4-1.mga3
3.2.4-1.mga3
facter
Red Hat:openstack:3::el6
 before 0:1.6.6-1.el6_4
0:1.6.6-1.el6_4
Show 9 moreShow less
Affected packages
PackageAffectedFixed
hiera
Red Hat:openstack:3::el6
 before 0:1.0.0-3.el6_4
0:1.0.0-3.el6_4
puppet
Red Hat:openstack:3::el6
 before 0:3.2.4-1.el6_4
0:3.2.4-1.el6_4
puppet-server
Red Hat:openstack:3::el6
 before 0:3.2.4-1.el6_4
0:3.2.4-1.el6_4
ruby-augeas
Red Hat:openstack:3::el6
 before 0:0.4.1-1.el6_4
0:0.4.1-1.el6_4
ruby-augeas-debuginfo
Red Hat:openstack:3::el6
 before 0:0.4.1-1.el6_4
0:0.4.1-1.el6_4
ruby-shadow
Red Hat:openstack:3::el6
 before 0:1.4.1-13.el6_4
0:1.4.1-13.el6_4
ruby-shadow-debuginfo
Red Hat:openstack:3::el6
 before 0:1.4.1-13.el6_4
0:1.4.1-13.el6_4
ruby193-puppet
Red Hat:openstack:3::el6
 before 0:3.1.1-11.1.el6ost
0:3.1.1-11.1.el6ost
ruby193-puppet-server
Red Hat:openstack:3::el6
 before 0:3.1.1-11.1.el6ost
0:3.1.1-11.1.el6ost

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4761 is a medium vulnerability (CVSS 5.1) in Puppet, published August 20, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. Fixed in puppet 2.7.23.

References

Show 50 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open