Cleartext Storage of Sensitive Information in Octopus Server by Octopus Deploy

CVE-2021-31816

What is CVE-2021-31816?

In Octopus Server, when configured with an external SQL database, the initial setup process inadvertently records the database password in the OctopusServer.txt log file in plaintext format. This raises significant security concerns since plaintext storage of sensitive credentials can lead to unauthorized access and exploitation, making it crucial for users to review their logging practices and configurations to mitigate potential risks.

References