Lucene search

[email protected]CVE-2021-31820

HistoryAug 18, 2021 - 11:15 a.m.

CVE-2021-31820

2021-08-1811:15:08

CWE-312

[email protected]

web.nvd.nist.gov

octopus server

vulnerability

authentication

password

nvd

cve-2021-31820

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.9%

JSON

In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI.

Affected configurations

NVD

Node

octopusoctopus_serverRange2018.8.2–2020.6.5310

octopusoctopus_serverRange2021.1.0–2021.1.7622

AND

linuxlinux_kernelMatch-

microsoftwindowsMatch-

CPENameOperatorVersion
octopus:octopus_serveroctopus octopus serverlt2020.6.5310
octopus:octopus_serveroctopus octopus serverlt2021.1.7622

CPE	Name	Operator	Version
octopus:octopus_server	octopus octopus server	lt	2020.6.5310
octopus:octopus_server	octopus octopus server	lt	2021.1.7622

CNA Affected

[
  {
    "product": "Octopus Server",
    "vendor": "Octopus Deploy",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2018.8.2",
        "versionType": "custom"
      },
      {
        "lessThan": "2020.6.5310",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "2021.1.7149",
        "versionType": "custom"
      },
      {
        "lessThan": "2021.1.7622",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

advisories.octopus.com/adv/2021-07---Proxy-Password-Stored-in-Plaintext-%28CVE-2021-31820%29.2193063986.html

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.9%

JSON

Related for CVE-2021-31820

cvelist1 prion1 nvd1