CVE-2021-21270 Cleartext Storage of Sensitive Information
Attackers can read exposed API keys from logs in OctopusDSC, potentially compromising Octopus Server connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21270?
CVE-2021-21270 is a medium-severity vulnerability in OctopusDeploy OctopusDSC, published on 22 Jan 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.
Weakness: CWE-319
Which versions are affected by CVE-2021-21270?
It affects 1 product.
Products include Octopus Octopusdsc.
How do I fix CVE-2021-21270?
No fix has been published for CVE-2021-21270 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21270 being exploited?
There is no known exploitation of CVE-2021-21270 in the wild and no public exploit code.
Sources
Also known as GHSA-phmm-rfg9-94fm.