Design/Logic Flaw

2021-01-2218:15:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.

CPENameOperatorVersion
octopusdsclt4.0.1002

CPE	Name	Operator	Version
	octopusdsc	lt	4.0.1002

References

github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42

github.com/OctopusDeploy/OctopusDSC/pull/270

github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002

github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fm