CVE-2021-30183
Last modified
CVE-2021-30183 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.. EPSS estimates a 0.87% chance of exploitation in the next 30 days.
Description
Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Octopus | Server | < 2020.5.329 |
| Octopus | Server | >= 2020.6.0, < 2020.6.4847 |
| Octopus | Server | >= 2021.1.0, < 2021.1.6959 |
References
- https://github.com/OctopusDeploy/IssuesThird Party Advisory
- https://github.com/OctopusDeploy/IssuesThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-30183?
How severe is CVE-2021-30183?
How do I fix CVE-2021-30183?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-30177There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in …9.8
- CVE-2021-30178An issue was discovered in the Linux kernel through 5.11.11.…5.5
- CVE-2021-30179Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports ge…9.8
- CVE-2021-3018ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerabl…9.8
- CVE-2021-30180Apache Dubbo prior to 2.7.9 support Tag routing which will e…9.8
- CVE-2021-30181Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routin…9.8
- CVE-2021-30184GNU Chess 6.2.7 allows attackers to execute arbitrary code v…7.8
- CVE-2021-30185CERN Indico before 2.3.4 can use an attacker-supplied Host h…7.5
- CVE-2021-30186CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-base…7.5
- CVE-2021-30187CODESYS V2 runtime system SP before 2.4.7.55 has Improper Ne…5.3
- CVE-2021-30188CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-bas…9.8
- CVE-2021-30189CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buff…9.8
Are you affected by CVE-2021-30183?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST