CVE-2021-31817

Thursday, July 08, 2021

N/A

Summary

When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

Affected Software

Vendor	Product	Version Range	Status
Octopus Deploy	Octopus Server	`2020.6.4671 < unspecified`	affected
Octopus Deploy	Octopus Server	`unspecified < 2020.6.5146`	affected
Octopus Deploy	Octopus Server	`2021.1.7149 < unspecified`	affected
Octopus Deploy	Octopus Server	`unspecified < 2021.1.7316`	affected

Weaknesses

Cleartext Storage of Sensitive Information (Linux Container)

ADP Enrichment

CVE Program Container

Additional References

https://advisories.octopus.com/adv/2021-06—Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-31817%29.2121138201.html

References

https://advisories.octopus.com/adv/2021-06—Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-31817%29.2121138201.html

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.