« Volver al listado

CVE-2024-12226

Estado: AplazadaMedia (6.5)—

In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions accordingly.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Octopus — Kubernetes AgentAIOctopus — Kubernetes WorkerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-12226",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-12226",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-16T14:21:00.502702Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@octopus.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@octopus.com",
      "affectedData": [
        {
          "vendor": "Octopus Deploy",
          "product": "Kubernetes Worker or Kubernetes Agent",
          "versions": [
            {
              "status": "affected",
              "version": "1.x",
              "lessThan": "1.19.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.x",
              "lessThan": "2.8.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-16T07:15:26.333",
  "references": [
    {
      "url": "https://advisories.octopus.com/post/2024/sa2024-10/",
      "source": "security@octopus.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@octopus.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions accordingly."
    },
    {
      "lang": "es",
      "value": "En las versiones afectadas del agente o trabajador de Octopus Kubernetes, se podían escribir variables confidenciales en el registro del pod del script de Kubernetes en texto plano. Esto se identificó en la versión 2, pero se determinó que esto también se podía lograr en la versión 1 y la solución se aplicó a ambas versiones en consecuencia."
    }
  ],
  "lastModified": "2026-06-17T06:59:17.277",
  "sourceIdentifier": "security@octopus.com"
}