CVE-2018-11746 — Puppet Discovery can leak authentication information
In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is…
Published: 2018-07-03 · CVSS: 8.6 · CVSS 3.0
In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7