PT-2021-19528 · Unknown · Octopus Server

Published 2021-08-18 · Updated 2021-08-25 · CVE-2021-31820

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Octopus Server versions 2018.8.3 and later

Description The issue concerns the Octopus Server Web Request Proxy, where if configured with authentication, the password is displayed in plaintext in the UI.

Recommendations For Octopus Server versions 2018.8.3 and later, consider disabling the Web Request Proxy authentication until a fix is available to prevent the password from being shown in plaintext.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2021-31820

Affected Products

Octopus Server

References · 4

• https://osv.dev/vulnerability/CVE-2021-31820 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31820 · Security Note
• https://advisories.octopus.com/adv/2021-07---Proxy-Password-Stored-in-Plaintext-%28CVE-2021-31820%29.2193063986.html · Note
• https://t.me/cibsecurity/27498 · Telegram Post