Puppet Discovery vulnerabilities

2 vulnerabilities

Known vulnerabilities in Puppet Discovery, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2018-11746puppetdiscovery+1
EPSS score
1.38%
In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.9.8CVE-2018-11747puppetdiscovery+1
EPSS score
0.72%
Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress.