Skip to content

Product

puppet discovery vulnerabilities

2 published CVES affecting puppet discovery, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
2
High
0
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest puppet discovery CVEs

Newest publication first

  1. CVE-2018-11747 Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be a...

    Published
    CriticalCVSS 9.8 EPSS 0.72%

    Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress.

  2. CVE-2018-11746 Puppet Discovery can leak authentication information

    Published
    CriticalCVSS 9.8 EPSS 1.4%

    In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.