Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2018-11746

Puppet Discovery can leak authentication information

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
puppet

Description

In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Puppet Puppet Discovery

  • unspecified to < 1.2.0affected

References