Medium severity · published Jan 22, 2021
CVE-2021-21270
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Octopusdsc · Octopus
before 4.0.1002 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21270
Patch
https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42
Patch
https://github.com/OctopusDeploy/OctopusDSC/pull/270
Release Notes
https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002
Third Party Advisory
https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fm