Описание
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.
Ссылки
- Issue TrackingThird Party Advisory
- Issue TrackingThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 3.0.8 (включая) до 2019.7.6 (включая)Версия от 3.0.8 (включая) до 5.0.0 (включая)
Одно из
cpe:2.3:a:octopus:server:*:*:*:*:*:*:*:*
cpe:2.3:a:octopus:tentacle:*:*:*:*:*:*:*:*
EPSS
Процентиль: 54%
0.00318
Низкий
6.5 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-312
Связанные уязвимости
CVSS3: 6.5
github
больше 3 лет назад
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.
EPSS
Процентиль: 54%
0.00318
Низкий
6.5 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-312