1. Home
  2. CVE Database
  3. CVE-2018-11746
HIGH · 8.6

CVE-2018-11746

In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This ca...

Vulnerability Description

In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.

CVSS Score

8.6

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
PuppetDiscovery< 1.2.0

Related Weaknesses (CWE)

CWE-522

References

FAQ

What is CVE-2018-11746?

CVE-2018-11746 is a vulnerability with a CVSS score of 8.6 (HIGH). In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This ca...

How severe is CVE-2018-11746?

CVE-2018-11746 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-11746?

Check the references section above for vendor advisories and patch information. Affected products include: Puppet Discovery.