ByteOS Network

NVD Vulnerability Details :

CVE-2019-8944

Analyzed

Source-cve@mitre.org

Published At-20 Feb, 2019 | 03:29

Updated At-27 Jul, 2022 | 16:42

An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive Terraform output variables via log files.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

Octopus Deploy Pty. Ltd.

>>octopus_deploy>>Versions up to 2018.9.17(inclusive)

cpe:2.3:a:octopus:octopus_deploy:*:*:*:*:*:*:*:*

Octopus Deploy Pty. Ltd.

>>octopus_deploy>>2018.10.0

cpe:2.3:a:octopus:octopus_deploy:2018.10.0:*:*:*:lts:*:*:*

Octopus Deploy Pty. Ltd.

>>octopus_deploy>>2018.10.1

cpe:2.3:a:octopus:octopus_deploy:2018.10.1:*:*:*:lts:*:*:*

Octopus Deploy Pty. Ltd.

>>octopus_deploy>>2018.10.2

cpe:2.3:a:octopus:octopus_deploy:2018.10.2:*:*:*:lts:*:*:*

Octopus Deploy Pty. Ltd.

>>octopus_deploy>>2018.10.3

cpe:2.3:a:octopus:octopus_deploy:2018.10.3:*:*:*:lts:*:*:*

Octopus Deploy Pty. Ltd.

>>octopus_server>>Versions from 2018.11.0(inclusive) to 2019.1.8(exclusive)

cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-532	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/OctopusDeploy/Issues/issues/5314	cve@mitre.org	Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/5315	cve@mitre.org	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History