CVE-2019-15508

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-15508
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15508.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-15508
Published
2019-08-23T06:15:10.540Z
Modified
2026-04-10T04:12:31.833852Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.

References

Affected packages

Git / github.com/octopusdeploy/octopustentacle

Affected ranges

Type
GIT
Repo
https://github.com/octopusdeploy/octopustentacle
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e28c9d269d10b345ac69f87b4cb9063149a4052b
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.8"
        },
        {
            "last_affected": "5.0.0"
        }
    ]
}

Affected versions

3.*
3.14.0-beta.1
3.14.0-beta.2
3.14.1
3.14.15
3.14.159
3.15.0
3.15.1
3.15.2
3.15.3
3.15.4
3.15.5
3.15.6
3.15.7
3.15.8
3.16.0
3.16.1
3.16.2
3.16.3
3.16.4
3.17.0
3.18.0
3.19.0
3.19.1
3.20.0
3.20.1
3.21.0
3.22.0
3.22.1
3.22.1-deleteme
3.22.2
3.23.0
3.23.1
3.23.2
3.24.0
3.25.0
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
5.*
5.0.0

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "3.0.8"
            },
            {
                "last_affected": "2019.7.6"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15508.json"