CVE-2021-31820

published 2021-08-18

CVE-2021-31820: In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the…

Priority P3 46 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
octopus	octopus_server	< 2020.6.5310	2020.6.5310
octopus	octopus_server	>= 2021.1.0 < 2021.1.7622	2021.1.7622
octopus_deploy	octopus_server	>= 2018.8.2 < unspecified	unspecified
octopus_deploy	octopus_server	>= 2021.1.7149 < unspecified	unspecified
octopus_deploy	octopus_server	>= unspecified < 2020.6.5310	2020.6.5310
octopus_deploy	octopus_server	>= unspecified < 2021.1.7622	2021.1.7622

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-312