CVE-2023-2247

Summary

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function

Affected Software

VendorProductVersion RangeStatus
Octopus DeployOctopus Server2018.3.0 < unspecifiedaffected
Octopus DeployOctopus Serverunspecified < 2022.3.10929affected
Octopus DeployOctopus Serverunspecified < 2022.4.791affected
Octopus DeployOctopus Serverunspecified < 2022.4.8319affected

Weaknesses

  • Variable preview can unmask secrets

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References