CVE-2021-21270

Katalog CVE

CVSS 5.5 · Medium EPSS 0,28%

Kerentanan Cleartext Transmission of Sensitive Information pada octopusdsc. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.

Rincian

Terbit di NVD

22 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42 patch · advisory pihak ketiga
• https://github.com/OctopusDeploy/OctopusDSC/pull/270 patch · advisory pihak ketiga
• https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002 release notes · advisory pihak ketiga
• https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fm advisory pihak ketiga