CVE-2023-1904: High severity octopus deploy vulnerability
Published Dec 14, 2023
·Updated
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.
Affected Software
3 affected components
Octopus Octopus Server>=2022.1.2121<2023.1.11942
Octopus Octopus Server>=2023.2.2028<2023.2.13151
Octopus Octopus Server>=2023.3.317<2023.3.5049
Event History
Dec 14, 2023
CVE Published
07:23 AM
Data Sourced
07:23 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-1904?
CVE-2023-1904 is a vulnerability in Octopus Server that allows the OpenID client secret to be logged in clear text during server configuration.
2
What versions are affected by CVE-2023-1904?
CVE-2023-1904 affects Octopus Server versions from 2022.1.2121 to 2023.1.11942, 2023.2.2028 to 2023.2.13151, and 2023.3.317 to 2023.3.5049.
3
What is the severity of CVE-2023-1904?
CVE-2023-1904 is classified with a high severity due to the potential exposure of sensitive information.
4
How do I fix CVE-2023-1904?
To fix CVE-2023-1904, update Octopus Server to a version that is not affected by this vulnerability.
5
Is there a workaround for CVE-2023-1904?
There is no documented workaround for CVE-2023-1904, hence updating is the recommended action.