Vulnerability in Octopus Server
CVE-2021-30183
Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.
EPSS: 0.009 (55.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Octopus Server
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-30183?
- CVE-2021-30183 is a high-severity vulnerability in Octopus Server, classified under Cleartext Storage of Sensitive Information. CVSS score: 7.5/10. Published 2021-05-14.
- How severe is CVE-2021-30183?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2021-30183 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.