CVE-2018-11749

CRITICAL

Puppet Enterprise < 2016.4.14 - Cleartext Transmission of Sensitive Information via startTLS LDAP Login

Title source: llm
STIX 2.1

Description

When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS score.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://puppet.com/security/cve/cve-2018-11749

Scores

CVSS v3 9.8
EPSS 0.0076
EPSS Percentile 50.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-319
Status published
Products (1)
puppet/puppet_enterprise < 2016.4.14
Published Aug 24, 2018
Tracked Since Feb 18, 2026