CVE-2018-12089

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is fixed in 2018.6.0.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:44

Type Values Removed Values Added
References () https://github.com/OctopusDeploy/Issues/issues/4628 - Third Party Advisory () https://github.com/OctopusDeploy/Issues/issues/4628 - Third Party Advisory

Information

Published : 2018-06-11 10:29

Updated : 2024-11-21 03:44


NVD link : CVE-2018-12089

Mitre link : CVE-2018-12089

CVE.ORG link : CVE-2018-12089


JSON object : View

Products Affected

octopus

  • octopus_server
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor