CVE-2018-11320: Critical severity octopus deploy vulnerability
Published May 21, 2018
·Updated
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs.
Affected Software
1 affected component
Octopus Octopus Server>=2018.4.4<=2018.5.1
Event History
May 21, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-11320?
CVE-2018-11320 is classified as a medium severity vulnerability.
2
How do I fix CVE-2018-11320?
To fix CVE-2018-11320, upgrade Octopus Deploy to version 2018.6.0 or later.
3
What is the main issue with CVE-2018-11320?
The main issue with CVE-2018-11320 is that sensitive variable values are not obfuscated in deployment logs.
4
Which versions of Octopus Deploy are affected by CVE-2018-11320?
CVE-2018-11320 affects Octopus Deploy versions from 2018.4.4 to 2018.5.1.
5
What are the implications of CVE-2018-11320 for users?
Users of Octopus Deploy may inadvertently expose sensitive information through deployment logs due to CVE-2018-11320.