Medium severity · published Aug 27, 2019
CVE-2019-15698
In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Octopus Server · Octopus
2019.7.3 through 2019.7.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15698
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15698
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/5810
More from Octopus Server
9.8
CVE-2024-9194
SQL Injection in the Octopus Server REST API
9.8
CVE-2022-2572
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keys of a disabled/deleted user were still…
9.8
CVE-2022-2778
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes
9.8
CVE-2018-11320
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs
9.1
CVE-2026-0704
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint