1. Home
  2. CVE Database
  3. CVE-2020-24566
HIGH · 7.5

CVE-2020-24566

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to ru...

Vulnerability Description

In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then (under certain circumstances) the account password is exposed in cleartext in the verbose task logs output.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
OctopusOctopus Deploy>= 2020.3, < 2020.3.4

Related Weaknesses (CWE)

CWE-532

References

FAQ

What is CVE-2020-24566?

CVE-2020-24566 is a vulnerability with a CVSS score of 7.5 (HIGH). In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to ru...

How severe is CVE-2020-24566?

CVE-2020-24566 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-24566?

Check the references section above for vendor advisories and patch information. Affected products include: Octopus Octopus Deploy.