Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fdn5-czrk-j3dx
Vulnerability ID VCID-fdn5-czrk-j3dx
Aliases CVE-2013-1655
GHSA-574q-fxfj-wv6h
Summary Puppet Improper Input Validation vulnerability Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-20 Improper Input Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
generic_textual HIGH http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
epss 0.00634 https://api.first.org/data/v1/epss?cve=CVE-2013-1655
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-574q-fxfj-wv6h
generic_textual HIGH https://github.com/puppetlabs/puppet
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-1655.yml
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2013-1655
generic_textual HIGH https://puppetlabs.com/security/cve/cve-2013-1655
generic_textual HIGH https://web.archive.org/web/20200228144801/http://www.securityfocus.com/bid/58442
generic_textual HIGH https://www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability
generic_textual HIGH http://ubuntu.com/usn/usn-1759-1
generic_textual HIGH http://www.debian.org/security/2013/dsa-2643
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
https://api.first.org/data/v1/epss?cve=CVE-2013-1655
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1655
http://secunia.com/advisories/52596
https://github.com/puppetlabs/puppet
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-1655.yml
https://nvd.nist.gov/vuln/detail/CVE-2013-1655
https://puppetlabs.com/security/cve/cve-2013-1655
https://web.archive.org/web/20200228144801/http://www.securityfocus.com/bid/58442
https://www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability
http://ubuntu.com/usn/usn-1759-1
http://www.debian.org/security/2013/dsa-2643
http://www.securityfocus.com/bid/58442
CVE-2013-1655 https://puppetlabs.com/security/cve/cve-2013-1655/
GHSA-574q-fxfj-wv6h https://github.com/advisories/GHSA-574q-fxfj-wv6h
GLSA-201308-04 https://security.gentoo.org/glsa/201308-04
USN-1759-1 https://usn.ubuntu.com/1759-1/
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.70715
EPSS Score 0.00634
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:57:23.043677+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-574q-fxfj-wv6h/GHSA-574q-fxfj-wv6h.json 38.6.0