{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T11:51:52.263","vulnerabilities":[{"cve":{"id":"CVE-2018-11746","sourceIdentifier":"security@puppet.com","published":"2018-07-03T13:29:00.233","lastModified":"2026-06-17T01:36:30.343","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery."},{"lang":"es","value":"En Puppet Discovery en versiones anteriores a la 1.2.0, cuando se ejecuta Discovery contra hosts Windows, las conexiones WinRM pueden desconectarse usando un auth básico en canales no seguros si un servidor HTTPS no está disponible. Esto puede exponer las credenciales de inicio de sesión utilizadas por Puppet Discovery."}],"affected":[{"source":"security@puppet.com","affectedData":[{"vendor":"Puppet","product":"Puppet Discovery","versions":[{"version":"unspecified","lessThan":"1.2.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"security@puppet.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:puppet:discovery:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.0","matchCriteriaId":"33DE8E5E-AA21-4932-AA7F-1BF3C1679264"}]}]}],"references":[{"url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","source":"security@puppet.com"},{"url":"https://puppet.com/security/cve/CVE-2018-11746","source":"security@puppet.com","tags":["Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://puppet.com/security/cve/CVE-2018-11746","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}