CVE-2018-11746

Puppet Discovery can leak authentication information

High · published July 3, 2018

CVSS v3.0
8.6
EPSS
1%
Percentile
71.9
In the wild
Unconfirmed
What it is

In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.

The record
Technical detail
CVSS v3.0
8.6 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01381 · 71.9th percentile
Published
2018-07-03T13:00Z
EPSS history
Timeline
  • 03 JUL 13:00Z
    Puppet Discovery can leak authentication information
    cvelistv5