CVE-2019-8944

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-20 · updated 2026-06-17
Weakness: CWE-532

Description

An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users to view sensitive Terraform output variables via log files.

Affected products

Octopus Deploy: through 2018.9.17; 2018.10.0, 2018.10.1, 2018.10.2, 2018.10.3
Octopus Deploy Octopus Server: from 2018.11.0 before 2019.1.8 — fixed in 2019.1.8

How to fix

Upgrade to a fixed version: Octopus Deploy Octopus Server 2019.1.8. Check the vendor advisory for mitigations.

References

https://github.com/OctopusDeploy/Issues/issues/5314
https://github.com/OctopusDeploy/Issues/issues/5315
https://github.com/OctopusDeploy/Issues/issues/5314
https://github.com/OctopusDeploy/Issues/issues/5315

Get alerted when CVE-2019-8944 or the next vulnerability affects your stack