CVE-2018-12089

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is fixed in 2018.6.0.
References
Link Resource
https://github.com/OctopusDeploy/Issues/issues/4628 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*

History

27 Jul 2022, 15:40

Type Values Removed Values Added
CPE cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:*:*:*:* cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*

Information

Published : 2018-06-11 10:29

Updated : 2024-02-04 19:46


NVD link : CVE-2018-12089

Mitre link : CVE-2018-12089

CVE.ORG link : CVE-2018-12089


JSON object : View

Products Affected

octopus

  • octopus_server
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor