CVE-2019-15507

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. The fix was back-ported to LTS 2019.6.7 as well as LTS 2019.3.8.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312 CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155086.5In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintV CVE-2019-15515.3There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affect CVE-2019-155106.1ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the descri CVE-2019-155117.8An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Co CVE-2019-155137.5An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used on Motorola CX2L MWR0 CVE-2019-155145.3The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is No CVE-2019-155156.5Discourse 2.3.2 sends the CSRF token in the query string.CVE-2019-155167.5Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.CVE-2019-155175.5jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.CVE-2019-155185.3Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.CVE-2019-155199.8Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.CVE-2019-15523.3OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in T