CVE-2018-12089 - CVE House
Back to Database
Status published High CVE-2018-12089

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with...

Vulnerability Description

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is fixed in 2018.6.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-12089

Credits & Attribution

No credits recorded in the NVD database.

References

More from octopus

View All →
CVE-2021-30183
Cleartext storage of sensitive information in multiple versions of Octopus...
High 7.5
CVE-2020-27155
An issue was discovered in Octopus Deploy through 2020.4.4. If...
High 7.5
CVE-2020-26161
In Octopus Deploy through 2020.4.2, an attacker could redirect users...
Medium 6.1
CVE-2020-25825
In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal...
High 7.5
CVE-2020-24566
In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1,...
High 7.5

Affected Vendor

Affected Software

octopus server
Vulnerable Versions:
2018.5.1

Timeline

Official Publish: June 11th, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.