« Volver al listado

CVE-2023-1904

Estado: ModificadaAlta (7.5)—

In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Octopus — Octopus Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-1904",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@octopus.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@octopus.com",
      "affectedData": [
        {
          "vendor": "Octopus Deploy",
          "product": "Octopus Server",
          "versions": [
            {
              "status": "affected",
              "version": "2022.2.7897",
              "lessThan": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2023.1.11942",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2023.2.13151",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2023.3.5049",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-14T08:15:36.550",
  "references": [
    {
      "url": "https://advisories.octopus.com/post/2023/sa2023-12/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@octopus.com"
    },
    {
      "url": "https://advisories.octopus.com/post/2023/sa2023-12/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server."
    },
    {
      "lang": "es",
      "value": "En las versiones afectadas de Octopus Server, es posible que el secreto del cliente OpenID se registre en texto plano durante la configuración de Octopus Server."
    }
  ],
  "lastModified": "2026-06-17T05:29:00.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E426B3F4-E5BE-4167-AAF0-1D66CB5F07A1",
              "versionEndExcluding": "2023.1.11942",
              "versionStartIncluding": "2022.1.2121"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "195CB35A-22A1-43CD-B49C-26A305EA4193",
              "versionEndExcluding": "2023.2.13151",
              "versionStartIncluding": "2023.2.2028"
            },
            {
              "criteria": "cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BAB3AC7-59E2-4590-97DA-D84C4705C69F",
              "versionEndExcluding": "2023.3.5049",
              "versionStartIncluding": "2023.3.317"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@octopus.com"
}