CVE-2021-21270 – Cleartext Storage of Sensitive Information

https://notcve.org/view.php?id=CVE-2021-21270

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is patched in version 4.0.1002. OctopusDSC es un módulo de PowerShell con recursos de DSC, que se puede utilizar para instalar y configurar un agente de Octopus Deploy Server and Tentacle. En OctopusDSC versión 4.0.977 y anteriores, una clave de la API del cliente usada para conectarse a Octopus Server es expuesta mediante el inicio de sesión en texto plano. • https://github.com/OctopusDeploy/OctopusDSC/commit/24b448e6ac964ed938475add494a145c0473ac42 https://github.com/OctopusDeploy/OctopusDSC/pull/270 https://github.com/OctopusDeploy/OctopusDSC/releases/tag/v4.0.1002 https://github.com/OctopusDeploy/OctopusDSC/security/advisories/GHSA-phmm-rfg9-94fm • CWE-319: Cleartext Transmission of Sensitive Information •