Cleartext Storage of Database Passwords in Octopus Server by Octopus Deploy

CVE-2021-31817

What is CVE-2021-31817?

In Octopus Server, a security concern arises during the initial configuration with an external SQL database. The database password is inadvertently logged in plaintext in the OctopusServer.txt log file, exposing sensitive information that could be leveraged by attackers. This vulnerability underscores the importance of securing log files and protecting sensitive data, particularly during initial setup procedures.

References