CVE-2019-8944 Information disclosure in n/a

What is CVE-2019-8944?

CVE-2019-8944 is a medium-severity vulnerability in Octopus Octopus Server, published on 20 Feb 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive Terraform output variables via log files.

Weakness: CWE-532

Which versions are affected by CVE-2019-8944?

It affects 2 products.

Products include Octopus Octopus Deploy, Octopus Octopus Server.

How do I fix CVE-2019-8944?

No fix has been published for CVE-2019-8944 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-8944 being exploited?

There is no known exploitation of CVE-2019-8944 in the wild and no public exploit code.

Other vulnerabilities in Octopus Octopus Server

• CVE-2020-10678 Privilege escalation in n/a High 8.8
• CVE-2018-5706 An issue was discovered in Octopus Deploy before 4.1.9. High 8.8
• CVE-2018-4862 Privilege escalation in n/a High 8.8
• CVE-2017-17665 Missing authorization in n/a High 8.8
• CVE-2019-11632 Missing authorization in n/a High 8.1

All Octopus Octopus Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r96x-g4h4-74q6.