CVE-2021-21270 MEDIUM

CVE-2021-21270: Cleartext Storage of Sensitive Information

Vendor Octopusdeploy
Product OctopusDSC
Weakness CWE-319 · Cleartext transmission
Published January 22, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

6.2/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.

Key dates

02Disclosure timeline

January 22, 2021 CVE published
August 3, 2024 Record updated