CVE-2018-11746

—

CVSS 3.0

9.8 critical

EPSS

1%p70

Published

Jul 3, 2018 (Jul 3, 2018)

Modified

Jun 17, 2026

Description

In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.

Vendors: puppet
Products: discovery
Weakness: CWE-522
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news0 stories

No ingested article mentions this CVE yet.