PT-2018-10801 · Puppet · Puppet Discovery

Publicado 2018-07-03 · Atualizado 2020-12-16 · CVE-2018-11746

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Puppet Discovery versions prior to 1.2.0

Description The issue allows WinRM connections to fall back to using basic auth over insecure channels if a HTTPS server is not available, potentially exposing login credentials used by Puppet Discovery when running against Windows hosts.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider configuring Puppet Discovery to only use HTTPS servers for WinRM connections to minimize the risk of credential exposure. Restrict access to sensitive Windows hosts until the update is applied.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-11746

Produtos afetados

Puppet Discovery

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-11746 · Aviso do Fabricante
• https://puppet.com/security/cve/CVE-2018-11746 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11746 · Nota de Segurança
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Nota