CVE-2013-1640

The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.

• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0710.htmlThird Party Advisory
• http://secunia.com/advisories/52596Third Party Advisory
• http://ubuntu.com/usn/usn-1759-1Third Party Advisory
• http://www.debian.org/security/2013/dsa-2643Third Party Advisory
• https://puppetlabs.com/security/cve/cve-2013-1640/Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0710.htmlThird Party Advisory
• http://secunia.com/advisories/52596Third Party Advisory
• http://ubuntu.com/usn/usn-1759-1Third Party Advisory
• http://www.debian.org/security/2013/dsa-2643Third Party Advisory
• https://puppetlabs.com/security/cve/cve-2013-1640/Vendor Advisory

Published

Mar 20, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-1634A denial of service vulnerability exists in some motherboard…7.5
• CVE-2013-1635ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13…
• CVE-2013-1636Cross-site scripting (XSS) vulnerability in open-flash-chart…
• CVE-2013-1637Opera before 12.13 allows remote attackers to execute arbitr…
• CVE-2013-1638Opera before 12.13 allows remote attackers to execute arbitr…
• CVE-2013-1639Opera before 12.13 does not send CORS preflight requests in …
• CVE-2013-1641Directory traversal vulnerability in the zip download functi…
• CVE-2013-1642Multiple cross-site scripting (XSS) vulnerabilities in QuiXp…6.1
• CVE-2013-1643The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13…
• CVE-2013-1645Directory traversal vulnerability in Open-Xchange Server bef…
• CVE-2013-1646Multiple cross-site scripting (XSS) vulnerabilities in Open-…
• CVE-2013-1647Multiple CRLF injection vulnerabilities in Open-Xchange Serv…