PT-2024-13214 · Octopus Deploy+1 · Octopus Server

CVE-2023-4509 · Published 2024-04-17 · Updated 2025-07-02

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue allows an API key to be logged in clear text in the audit log file after an invalid login attempt.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2023-4509

Affected Products

Octopus Server

References · 6

• https://osv.dev/vulnerability/CVE-2023-4509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4509 · Security Note
• https://advisories.octopus.com/post/2024/sa2024-02 · Vendor Advisory
• https://t.me/cvenotify/127464 · Telegram Post
• https://twitter.com/CVEnew/status/1781029459086176734 · Twitter Post
• https://t.me/cvenotify/77244 · Telegram Post