CVE-2019-19375

In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute

published November 28, 2019

CVSS
—
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.4th percentile
Published
2019-11-28T16:16Z
EPSS history
Timeline
  • 28 NOV 16:16Z
    In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute
    cvelistv5