CVE-2019-19375

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-28 · updated 2026-06-17
Weakness: CWE-352

Description

In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)

Affected products

Octopus Deploy: before 2019.10.7; from 2019.6.0 before 2019.6.14; from 2019.9.0 before 2019.9.8 — fixed in 2019.10.7, 2019.6.14, 2019.9.8

How to fix

Upgrade to a fixed version: Octopus Deploy 2019.10.7, 2019.6.14, 2019.9.8. Check the vendor advisory for mitigations.

References

https://github.com/OctopusDeploy/Issues/issues/5998
https://github.com/OctopusDeploy/Issues/issues/5998

Get alerted when CVE-2019-19375 or the next vulnerability affects your stack