CVE-2024-6972: Medium severity octopus deploy vulnerability
Published Jul 25, 2024
·Updated
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in clear-text.
Affected Software
5 affected components
Octopus Deploy Octopus Server
All of the following
Any of the following
Octopus Octopus Server>=2024.1.437<2024.1.12759
Octopus Octopus Server>=2024.2.101<2024.2.9193
Any of the following
Linux Linux kernel
Microsoft Windows
Event History
Jul 25, 2024
CVE Published
via MITRE·05:16 AM
Data Sourced
via MITRE·05:16 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-6972?
CVE-2024-6972 is classified as a medium severity vulnerability due to the potential exposure of sensitive information.
2
How do I fix CVE-2024-6972?
To fix CVE-2024-6972, upgrade to the latest version of Octopus Server that addresses this vulnerability.
3
What versions of Octopus Server are affected by CVE-2024-6972?
CVE-2024-6972 affects multiple versions of Octopus Server prior to the patch release that resolves this issue.
4
What type of data is affected by CVE-2024-6972?
CVE-2024-6972 can lead to sensitive variables being logged in clear-text, posing a risk of unauthorized access.
5
Can CVE-2024-6972 lead to data breaches?
Yes, CVE-2024-6972 can potentially lead to data breaches if sensitive information is exposed in the task logs.