CVE-2018-11746

CRITICAL 9.8CVE-2018-11746 · Published 03/07/2018 · updated 17/06/2026

In short

CVE-2018-11746 is a CRITICAL (CVSS 9.8) vulnerability affecting discovery (puppet).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.1% of all vulnerabilities.
Fix: update to 1.2.0 or later.

Package	Affected versions	Patched versions
discovery puppet	`< 1.2.0`	`1.2.0`

Description

In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.

References

lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
puppet.com/security/cve/CVE-2018-11746 · Vendor Advisory

More vulnerabilities in discovery

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free