PT-2021-18657 · Unknown · Octopus Server

Published 2021-05-14 · Updated 2022-07-27 · CVE-2021-30183

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Octopus Server versions (affected versions not specified)

Description The issue concerns the cleartext storage of sensitive information in Octopus Server. In certain situations, when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-30183

Affected Products

Octopus Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-30183 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30183 · Vendor Advisory
• https://github.com/OctopusDeploy/Issues · Note
• https://t.me/cvenotify/14426 · Telegram Post
• https://advisories.octopus.com/adv/2021-03---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-30183%29.1817083941.html · Note