CVE-2021-30183

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-14 · updated 2026-06-17
Weakness: CWE-312

Description

Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext.

Affected products

Octopus Server: before 2020.5.329; from 2020.6.0 before 2020.6.4847; from 2021.1.0 before 2021.1.6959 — fixed in 2020.5.329, 2020.6.4847, 2021.1.6959

How to fix

Upgrade to a fixed version: Octopus Server 2020.5.329, 2020.6.4847, 2021.1.6959. Check the vendor advisory for mitigations.

References

https://advisories.octopus.com/adv/2021-03---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-30183%29.1817083941.html
https://github.com/OctopusDeploy/Issues
https://advisories.octopus.com/adv/2021-03---Cleartext-Storage-of-Sensitive-Information-%28CVE-2021-30183%29.1817083941.html
https://github.com/OctopusDeploy/Issues

Get alerted when CVE-2021-30183 or the next vulnerability affects your stack