CVE-2023-2247

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

VendorProductVersions
Octopus DeployOctopus Server>= 2018.3.0, < unspecified; >= unspecified, < 2022.3.10929; >= unspecified, < 2022.4.791; >= unspecified, < 2022.4.8319

References

Timeline

Published
May 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-224706.5Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2023-224714.3Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken accCVE-2023-224728.8Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possCVE-2023-224732.1Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access tCVE-2023-224748.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request headerCVE-2023-224756.1Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identifCVE-2023-224764.3Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logCVE-2023-224777.5Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sendiCVE-2023-224787.5KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been pCVE-2023-224796.5KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and beCVE-2023-224809.8KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clustersCVE-2023-224815.5FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt`
CVE-2023-2247: Medium severity, CVSS 5.3 | Vulnix