CVE-2019-14525

MEDIUM 4.9CVE-2019-14525 · Published 05/08/2019 · updated 17/06/2026

In short

CVE-2019-14525 is a MEDIUM (CVSS 4.9) vulnerability affecting octopus deploy (octopus), octopus server (octopus).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.7% of all vulnerabilities.
Fix: update to 2019.6.6, 2019.7.6 or later.

Package	Affected versions	Patched versions
octopus deploy octopus	`≥ 2019.4.0, < 2019.6.6`	`2019.6.6`
octopus server octopus	`≥ 2019.7.0, < 2019.7.6`	`2019.7.6`

Description

In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call.

References

OctopusDeploy/Issues · Third Party Advisory
OctopusDeploy/Issues · Third Party Advisory
octopus.com/downloads/compare · Vendor Advisory

More vulnerabilities in octopus deploy

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

octopus deploy

octopus

≥ 2019.4.0, < 2019.6.6

2019.6.6

octopus server

octopus

≥ 2019.7.0, < 2019.7.6

2019.7.6

More vulnerabilities in octopus deploy

See all →