CVE-2013-4958: Puppet Enterprise

Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Puppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for attackers to gain privileges by leveraging an unattended workstation.

Affected products

• Puppet Puppet Enterprise: up to and including 3.0.0; version 2.5.1 only; version 2.5.2 only; version 2.8.0 only; version 2.8.1 only; version 2.8.2 only; …

Published 2013-08-20. Last modified 2026-06-16.