CVE-2019-15508

    Dashboard / Vulnerabilities / CVE-2019-15508

    CVE-2019-15508

    Published: 23 Aug 2019Last Modified: 8 Jul 2026

    Summary:

    Details: In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.

    References: https://github.com/OctopusDeploy/Issues/issues/5750

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    4.0.6
    4.0.5
    4.0.4
    4.0.3
    4.0.2
    4.0.1
    4.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High