9.8
CVE-2018-11749
- EPSS 0.15%
- Published 24.08.2018 13:29:00
- Last modified 21.11.2024 03:43:57
- Source security@puppet.com
- Teams watchlist Login
- Open Login
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS score.
Data is provided by the National Vulnerability Database (NVD)
Puppet ≫ Puppet Enterprise Version <= 2016.4.14
Puppet ≫ Puppet Enterprise Version >= 2017.3.0 <= 2017.3.9
Puppet ≫ Puppet Enterprise Version >= 2018.1.0 <= 2018.1.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.15% | 0.327 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
CWE-319 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.