CVE-2018-11746 - Puppet Discovery can leak authentication information

  • Posted June 28, 2018

  • Assessed Risk Level: High

  • CVSS 3 Base Score: 8.6

When running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.


Affected software versions:

  • Puppet Discovery prior to 1.2.0

Resolved in:

  • Puppet Discovery 1.2.0
Puppet sites use proprietary and third-party cookies. By using our sites, you agree to our cookie policy.