Description
In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Puppet | Puppet Discovery | unspecified – < 1.2.0 | 1.2.0 |