Variable Exposure Vulnerability in Octopus Deploy by Octopus Deploy
CVE-2023-2247

5.3MEDIUM

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
2 May 2023

What is CVE-2023-2247?

A vulnerability in specific versions of Octopus Deploy allows attackers to unmask sensitive variable secrets through the variable preview function. This flaw can potentially expose critical information, posing a security risk to organizations utilizing the platform. Users are advised to review their configurations and apply recommended patches to mitigate the risk of unauthorized access to sensitive data.

Affected Version(s)

Octopus Server 2018.3.0

Octopus Server < 2022.3.10929

Octopus Server < 2022.4.791

References

https://advisories.octopus.com/post/2023/sa2023-07/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-2247 : Variable Exposure Vulnerability in Octopus Deploy by Octopus Deploy