CVE-2021-21270

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
OctopusDeploy	OctopusDSC	< 4.0.1002

References

https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42Patch, Third Party Advisory
https://github.com/OctopusDeploy/OctopusDSC/pull/270Patch, Third Party Advisory
https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002Release Notes, Third Party Advisory
https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fmThird Party Advisory
https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42Patch, Third Party Advisory
https://github.com/OctopusDeploy/OctopusDSC/pull/270Patch, Third Party Advisory
https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002Release Notes, Third Party Advisory
https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fmThird Party Advisory

Timeline

Published: Jan 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-212716.5Tendermint Core is an open source Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine - written in any programmi CVE-2021-212727.7ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing CVE-2021-212736.1Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant CVE-2021-212746.5Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant CVE-2021-212754.3The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection agains CVE-2021-212769.3Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin acce CVE-2021-212778.8angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before vers CVE-2021-212789.8RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there i CVE-2021-212797.5Contiki-NG is an open-source, cross-platform operating system for internet of things devices. In verions prior to 4.6, an attacker can perfo CVE-2021-21286.5Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-212809.8Contiki-NG is an open-source, cross-platform operating system for internet of things devices. It is possible to cause an out-of-bounds write CVE-2021-212819.8Contiki-NG is an open-source, cross-platform operating system for internet of things devices. A buffer overflow vulnerability exists in Cont