CVE-2020-12286: In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension

Medium severity · published Apr 28, 2020

CVE-2020-12286

In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension

4.3

CVSS

EPSS

On KEV

Description

In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 62% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Octopus Deploy · Octopus

before 2019.12.9; 2020.1 before 2020.1.12 · source: NVD

Affected product

Octopus Deploy

Octopus

All Octopus Deploy CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-12286

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-12286

Third Party Advisory

https://github.com/OctopusDeploy/Issues/issues/6331

Third Party Advisory

https://github.com/OctopusDeploy/Issues/issues/6332

Third Party Advisory

https://github.com/OctopusDeploy/Issues/issues/6333