Octopus Deploy Octopus Server

CVE-2021-31816

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 0.86 % · centile 58 (2026-11-01)
État: PUBLISHED
Publiée: 2021-07-08 10:43 UTC
Mise à jour: 2024-08-03 23:10 UTC
Attribuée par: Octopus
Statut NVD: Modified

Rechercher sur…

Description

When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

Faiblesses (CWE)

CWE-312 — Stockage en clair d'informations sensibles

Références

https://advisories.octopus.com/adv/2021-05---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-31816%29.2121793537.html

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2021-18692
GCVE · GCVE-0-2021-31816

Configurations affectées (CPE NVD)

cpe:2.3:a:octopus:server:*:*:*:*:*:*:*:* < 2020.6.5146
cpe:2.3:a:octopus:server:*:*:*:*:*:*:*:* ≥ 2021.1.0 < 2021.1.7316

Produits affectés

Produit	Versions
Octopus Deploy · Octopus Server	affected 0.9 < unspecified ; affected unspecified < 2020.6.5146 ; affected 2021.1.7149 < unspecified ; affected unspecified < 2021.1.7316

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD