That's a little tricky to answer.    Yes, if you supply credentials to that URL it will show the BASIC Auth string in the packet and you "could" decode the credentials that way, but there is not a use case for someone accessing that URL in a browser, and in order to actually decode the credentials it would have to be done within that specific environment. Lastly, it isn't an issue also as your trying to use a URL that doesn't do anything and which the iDrac has no need of ever accessing.    Let me know if you get what I mean.      
I have a PowerEdge R720 server with iDRAC 7. A vulnerability scanner of the idrac IP has reported a wsman url that accepts clear text credentials. I found that if I navigate to "http:// /wsman" it does prompt me for credentials and does not redirect to HTTPS. I do have https redirect enabled. I'm wondering if there is a way to resolve this or to disable wsman support somehow on the idrac 
WSMAN HTTPS setup on idrac 7