Medium severity · published Nov 28, 2019
CVE-2019-19375
In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
Octopus Deploy · Octopus
before 2019.10.7; 2019.6.0 before 2019.6.14; 2019.9.0 before 2019.9.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19375
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19375
Third Party Advisory
https://github.com/OctopusDeploy/Issues/issues/5998
More from Octopus Deploy
8.8
CVE-2020-10678
In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate…
8.8
CVE-2018-5706
An issue was discovered in Octopus Deploy before 4.1.9
8.8
CVE-2018-4862
In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure account in such a way as to bypass the…
8.8
CVE-2017-17665
In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments
8.1
CVE-2019-11632
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a…