CVE-2021-31816

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-318177.5When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written CVE-2021-318184.3Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied d CVE-2021-318199.8In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already t CVE-2021-31828.0D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer supported by the maintaine CVE-2021-318207.5In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in CVE-2021-318215.5When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Se CVE-2021-318227.8When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to a CVE-2021-318267.5Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is CVE-2021-318278.8In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could all CVE-2021-318287.1An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or CVE-2021-318295.5kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via CVE-2021-31837.5Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login