[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQ6ZS8xNwRG6eer6V6Hs2RDDq5ZOfpRyGs6oOWNM-5Dk":3,"g5a-risk:CVE-2018-11746":118},{"success":4,"data":5,"meta":116},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":48,"epssPercentile":15,"epssTimeSeries":49,"severity":50,"affectedProducts":51,"affectedProductsCount":57,"references":58,"referencesCount":68,"weaknesses":69,"weaknessesCount":57,"isActivelyExploited":78,"cisaInfo":15,"otxData":15,"relatedBlogPosts":79,"seoMetadata":80,"configurations":105,"relatedVendorCves":114,"notableEvents":115},"CVE-2018-11746","What is CVE-2018-11746?","In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.","In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels ...","2018-07-03T13:29:00.233","2023-11-07T02:51:44.51",9.8,"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":16,"CVSSMetricV2":38,"CVSSMetricV40":15},null,[17,30],{"Source":18,"Type":19,"CVSSData":20,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":21,"VectorString":13,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":26,"IntegrityImpact":26,"AvailabilityImpact":26,"BaseScore":12,"BaseSeverity":27,"ExploitCodeMaturity":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"TemporalSeverity":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"ModifiedAttackVector":15,"ModifiedAttackComplexity":15,"ModifiedPrivilegesRequired":15,"ModifiedUserInteraction":15,"ModifiedScope":15,"ModifiedConfidentialityImpact":15,"ModifiedIntegrityImpact":15,"ModifiedAvailabilityImpact":15,"EnvironmentalScore":15,"EnvironmentalSeverity":15},"3.0","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",3.9,5.9,{"Source":31,"Type":32,"CVSSData":33,"ExploitabilityScore":28,"ImpactScore":37},"ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e","Secondary",{"Version":21,"VectorString":34,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":35,"ConfidentialityImpact":26,"IntegrityImpact":24,"AvailabilityImpact":24,"BaseScore":36,"BaseSeverity":26,"ExploitCodeMaturity":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"TemporalSeverity":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"ModifiedAttackVector":15,"ModifiedAttackComplexity":15,"ModifiedPrivilegesRequired":15,"ModifiedUserInteraction":15,"ModifiedScope":15,"ModifiedConfidentialityImpact":15,"ModifiedIntegrityImpact":15,"ModifiedAvailabilityImpact":15,"EnvironmentalScore":15,"EnvironmentalSeverity":15},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N","CHANGED",8.6,4,[39],{"Source":18,"Type":19,"CVSSData":40,"BaseSeverity":45,"ExploitabilityScore":46,"ImpactScore":47,"ACInsufInfo":4,"ObtainAllPrivilege":15,"ObtainUserPrivilege":15,"ObtainOtherPrivilege":15,"UserInteractionRequired":15},{"Version":41,"VectorString":42,"AccessVector":22,"AccessComplexity":23,"Authentication":24,"ConfidentialityImpact":43,"IntegrityImpact":24,"AvailabilityImpact":24,"BaseScore":44,"BaseSeverity":15,"Exploitability":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"CollateralDamagePotential":15,"TargetDistribution":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"EnvironmentalScore":15},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:P\u002FI:N\u002FA:N","PARTIAL",5,"MEDIUM",10,2.9,0.01381,[48,48,48,48,48,48,48],"Critical",[52],{"vendor":53,"product":54,"version":55,"criteria":56,"vulnerable":4},"puppet","discovery","*","cpe:2.3:a:puppet:discovery:*:*:*:*:*:*:*:*",1,[59,63],{"url":60,"source":61,"tags":62},"https:\u002F\u002Flists.apache.org\u002Fthread.html\u002Frd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","Apache",[],{"url":64,"source":65,"tags":66},"https:\u002F\u002Fpuppet.com\u002Fsecurity\u002Fcve\u002FCVE-2018-11746","Puppet",[67],"Vendor Advisory",2,[70],{"id":71,"name":72,"description":73,"extendedDescription":74,"status":75,"abstraction":76,"structure":77},"CWE-522","Insufficiently Protected Credentials","The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and\u002For retrieval.","","Incomplete","Class","Simple",false,[],{"title":81,"metaDescription":82,"keywords":83,"canonicalUrl":84,"structuredData":85},"What is CVE-2018-11746? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2018-11746, a critical severity cyber security vulnerability from 2018. In Puppet Discovery prior to 1.2.0, when running Discov...","CVE-2018-11746, CVE-2018-11746 vulnerability, CVE-2018-11746 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2018, CVSS score, exploit, patch, remediation, puppet security, discovery vulnerability","\u002Fwhat-is\u002Fcve-2018-11746",{"@context":86,"@type":87,"headline":81,"description":82,"datePublished":10,"dateModified":11,"author":88,"publisher":92,"about":96,"mainEntityOfPage":100,"articleSection":103,"keywords":104},"https:\u002F\u002Fschema.org","TechArticle",{"@type":89,"name":90,"url":91},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":89,"name":90,"url":91,"logo":93},{"@type":94,"url":95},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":97,"name":6,"description":98,"additionalType":99},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":101,"@id":102},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2018-11746","Cybersecurity","CVE-2018-11746, CVE-2018-11746 vulnerability, CVE-2018-11746 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[106],{"Operator":15,"Negate":15,"Nodes":107},[108],{"Operator":109,"Negate":15,"CPEMatch":110},"OR",[111],{"Vulnerable":4,"Criteria":56,"MatchCriteriaID":112,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":113,"VersionEndIncluding":15},"33DE8E5E-AA21-4932-AA7F-1BF3C1679264","1.2.0",[],[],{"lastModified":11,"cacheTime":117,"version":41},1792257680882,{"score":119,"band":120,"action":121,"scoredAt":122},54,"Medium","Plan remediation","2026-10-16T06:44:23.413413+00:00"]