CVE-2013-1653

CVE-2013-1653 describes a critical remote code execution vulnerability affecting Puppet versions before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, as well as Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2. When configured to listen for incoming connections and allow access to the "run" REST endpoint, an authenticated attacker can execute arbitrary code via a crafted HTTP request. This vulnerability carries a CVSS score of 7.1, indicating high severity due to its network-based attack vector, high impact on confidentiality, integrity, and availability, despite requiring authentication and high attack complexity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.