Back
CVE-2023-1904
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of…
Medium4.2EPSS 0.39%
- Published
- Updated
- Reserved
- Assigned by
- Octopus
Description
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.
Timeline
ID reserved
By Octopus
- 8 months later
· 8 months later
Published
- 9 months later
· 9 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| OctopusCNA (assigner) | 3.1 | Medium4.2 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.39% · top 67% of all CVEs (7 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.2.
Weakness
- OpenID client secret logged in plain text during configuration
- CWE-532 (opens in a new tab)All about CWE-532 and its CVEs
Affected products
Octopus Deploy · Octopus Server
- affected 2022.2.7897 – < unspecified
- affected unspecified – < 2023.1.11942
- affected unspecified – < 2023.2.13151
- affected unspecified – < 2023.3.5049
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-1904)Record last updated .