High severity · published Apr 30, 2018
CVE-2018-10550
In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
In Octopus Deploy before 2018.4.7, target and tenant tag variable scopes were not checked against the list of tenants the user has access to.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
Octopus Deploy · Octopus
before 2018.4.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10550
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10550
Issue Tracking
https://github.com/OctopusDeploy/Issues/issues/4454
More from Octopus Deploy
8.8
CVE-2020-10678
In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate…
8.8
CVE-2018-5706
An issue was discovered in Octopus Deploy before 4.1.9
8.8
CVE-2018-4862
In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure account in such a way as to bypass the…
8.8
CVE-2017-17665
In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments
8.1
CVE-2019-11632
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUnscoped or VariableEditUnscoped permission scoped to a…