What is CVE-2018-11749?

CVE-2018-11749 is a critical-severity vulnerability in Puppet Enterprise, classified under Cleartext Transmission of Sensitive Information. CVSS score: 9.8/10. Published 2018-08-24.

How severe is CVE-2018-11749?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Puppet Enterprise

CVE-2018-11749

When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise…

EPSS: 0.008 (51.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Puppet Enterprise — versions 2017.3.9, 2016.4.14, 2018.1.3
Puppet Puppet_enterprise

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

security@puppet.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-11749?: CVE-2018-11749 is a critical-severity vulnerability in Puppet Enterprise, classified under Cleartext Transmission of Sensitive Information. CVSS score: 9.8/10. Published 2018-08-24.
How severe is CVE-2018-11749?: Critical severity. CVSS v3 base score is 9.8 out of 10.