SB2019082307 - Information disclosure in Octopus Deploy
Published: August 23, 2019 Updated: August 30, 2019
Security Bulletin ID
SB2019082307
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-15507)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to logging passwords in clear text under certain circumstances, when a web request proxy is configured. A remote authenticated user can trigger a deployment that writes the web request proxy password to the deployment log and use those credentials to gain unauthorized access to the deployment with elevated privileges.
Remediation
Install update from vendor's website.