VulnerabilityModified

CVE-2021-31817

When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

HIGH 7.5EPSS 0.86%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.86% probability · 56th percentile
CISA KEV: Not listed
Weakness: CWE-312
Affected: octopus/server
Source: security@octopus.com

References

https://advisories.octopus.com/adv/2021-06---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-31817%29.2121138201.html
https://advisories.octopus.com/adv/2021-06---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-31817%29.2121138201.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.