In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is fixed in 2018.6.0.
References
Link | Resource |
---|---|
https://github.com/OctopusDeploy/Issues/issues/4628 | Third Party Advisory |
https://github.com/OctopusDeploy/Issues/issues/4628 | Third Party Advisory |
Configurations
History
21 Nov 2024, 03:44
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/OctopusDeploy/Issues/issues/4628 - Third Party Advisory |
Information
Published : 2018-06-11 10:29
Updated : 2024-11-21 03:44
NVD link : CVE-2018-12089
Mitre link : CVE-2018-12089
CVE.ORG link : CVE-2018-12089
JSON object : View
Products Affected
octopus
- octopus_server
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor